Windows Analysis Report
56bDgH9sMQ.exe

Overview

General Information

Sample name:	56bDgH9sMQ.exe renamed because original name is a hash value
Original sample name:	f88272ea7674d3acedd8adcf7643c598.exe
Analysis ID:	1465067
MD5:	f88272ea7674d3acedd8adcf7643c598
SHA1:	0066fd44e2cd9293af414f735bd80456f4e3eb1d
SHA256:	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387
Tags:	32exetrojan
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 56bDgH9sMQ.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "254862acdd5c5d2dddb209d751490c15"}

Multi AV Scanner detection for domain / URL

Source: https://195.201.251.214:9000/

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: 56bDgH9sMQ.exe	ReversingLabs: Detection: 78%
Source: 56bDgH9sMQ.exe	Virustotal: Detection: 81%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 56bDgH9sMQ.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Sleep
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: user32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sscanf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NtQueryInformationProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32Next
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32First
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindClose
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: WriteFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLastError
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SelectObject
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BitBlt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrStrA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmGetList
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PATH
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Soft:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: profile:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Host:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Login:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Password:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OperaGX
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Network
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: .txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: TRUE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FALSE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Autofill
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: History
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Name:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Month:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Year:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Card:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Login Data
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Web Data
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: History
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: logins.json
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: usernameField
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: guid
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Plugins
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Local State
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: opera
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: firefox
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Wallets
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ProductName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Temp\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: .exe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: runas
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: open
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: /c start
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.lnk
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Files
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \discord\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: key_datas
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: map*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Telegram
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.tox
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.ini
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Password
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000001
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000002
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000003
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000004
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Pidgin
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \.purple\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: token:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SteamPath
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \config\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ssfn*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: config.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Steam\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: browsers
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: done
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Soft
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: https
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: POST
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: hwid
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: build
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: token
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: file_name
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: file
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: message
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	2_2_0040AB80

Uses 32bit PE files

Source: 56bDgH9sMQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49729 version: TLS 1.2

Source: 56bDgH9sMQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7D43A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00C7D43A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

2_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 195.201.251.214:9000

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.201.251.214 195.201.251.214
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004058C4 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_004058C4

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabU
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.3059706010.000000001FC6D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/0cosoft
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9zn
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/:9000
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/O
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllatch
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllffsets
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllm
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllu
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/l
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dlla
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllo
Source: RegAsm.exe, 00000002.00000002.3052745059.0000000001135000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllet
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nes
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllA
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllU
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllo
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nzC
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllV
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllll
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000539000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllD
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dlls
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllt
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/y
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:900030cle
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Google
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: BGDAAK.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BGDAAK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3055858373.00000000196AC000.00000004.00000020.00020000.00000000.sdmp, BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3055858373.00000000196AC000.00000004.00000020.00020000.00000000.sdmp, BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nJt
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/pjm
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: BGDAAK.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BGDAAK.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49729 version: TLS 1.2

Contains functionality to record screenshots

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00413160 memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

2_2_00413160

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.42e038.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth

Detected potential crypto function

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C87930	0_2_00C87930
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C73050	0_2_00C73050
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6F934	0_2_00C6F934
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C8123B	0_2_00C8123B
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C64430	0_2_00C64430
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C76DB9	0_2_00C76DB9
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C777D9	0_2_00C777D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ECEC	2_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E919	2_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041EEC1	2_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F6CF	2_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA34CF0	2_2_1FA34CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA212A8	2_2_1FA212A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22AA9	2_2_1FA22AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB89CC0	2_2_1FB89CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2292D	2_2_1FA2292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB49A20	2_2_1FB49A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22018	2_2_1FA22018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAD5940	2_2_1FAD5940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21C9E	2_2_1FA21C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC9690	2_2_1FAC9690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB89430	2_2_1FB89430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB53B0	2_2_1FAB53B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23580	2_2_1FA23580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FBFD209	2_2_1FBFD209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA39000	2_2_1FA39000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB45040	2_2_1FB45040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48D2A	2_2_1FA48D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB24A60	2_2_1FB24A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21EF1	2_2_1FA21EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48763	2_2_1FA48763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA84760	2_2_1FA84760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB8760	2_2_1FAB8760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48680	2_2_1FA48680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB60480	2_2_1FB60480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23AB2	2_2_1FA23AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA8120	2_2_1FAA8120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA0090	2_2_1FAA0090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB48030	2_2_1FB48030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2290A	2_2_1FA2290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4BAB0	2_2_1FA4BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2251D	2_2_1FA2251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53370	2_2_1FA53370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2174E	2_2_1FA2174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FBFAEBE	2_2_1FBFAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA82EE0	2_2_1FA82EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA219DD	2_2_1FA219DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2EA80	2_2_1FA2EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2AA40	2_2_1FA2AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB069C0	2_2_1FB069C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB3A900	2_2_1FB3A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB1A940	2_2_1FB1A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2481D	2_2_1FA2481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23E3B	2_2_1FA23E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB5E800	2_2_1FB5E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA366C0	2_2_1FA366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB1A590	2_2_1FB1A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4A560	2_2_1FA4A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA247AF	2_2_1FA247AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAAA0B0	2_2_1FAAA0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2209F	2_2_1FA2209F

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: String function: 00C69B60 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA21C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FC006B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA2415B appears 118 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA2395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA21F5A appears 31 times

One or more processes crash

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 324

Uses 32bit PE files

Source: 56bDgH9sMQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 2.2.RegAsm.exe.42e038.1.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/14@5/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041246A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_0041246A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004129BF CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

2_2_004129BF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\JFUY9M9X.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7736

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\798e780e-3e0e-4fee-afc4-0c3b6c94dd7d

Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HDGDHC.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 56bDgH9sMQ.exe	ReversingLabs: Detection: 78%
Source: 56bDgH9sMQ.exe	Virustotal: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\56bDgH9sMQ.exe "C:\Users\user\Desktop\56bDgH9sMQ.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 324
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 56bDgH9sMQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 56bDgH9sMQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041B050 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0041B050

PE file contains sections with non-standard names

Source: sqlt[1].dll.2.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69536 push ecx; ret	0_2_00C69549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421EF5 push ecx; ret	2_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2D3AF push ebx; ret	2_2_1FA2D3B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB97 push ebx; ret	2_2_1FA2CB98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB9E push ebx; ret	2_2_1FA2CB9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21BF9 push ecx; ret	2_2_1FBC4C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB6B push ebx; ret	2_2_1FA2CB6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB7F push ebx; ret	2_2_1FA2CB82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB53 push ebx; ret	2_2_1FA2CB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA210C8 push ecx; ret	2_2_1FC23552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5322D push esp; ret	2_2_1FA5322E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA531AF push esp; ret	2_2_1FA531B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53187 push ebp; ret	2_2_1FA53188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5319A push esi; ret	2_2_1FA5319C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53125 push esp; ret	2_2_1FA53126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53164 push ebp; ret	2_2_1FA53167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53160 push ebp; ret	2_2_1FA53161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5317D push ebp; ret	2_2_1FA5317E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530E8 push ebp; ret	2_2_1FA530E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530F2 push ebp; ret	2_2_1FA530F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530C7 push ebp; ret	2_2_1FA530C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530CD push ebp; ret	2_2_1FA530CE

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0041B050

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7D43A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00C7D43A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

2_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411F21 GetSystemInfo,wsprintfA,

2_2_00411F21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareb
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2K
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_0086018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,LdrInitializeThunk,LdrInitializeThunk,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,LdrInitializeThunk,LdrInitializeThunk,Wow64SetThreadContext,LdrInitializeThunk,LdrInitializeThunk,ResumeThread,ResumeThread,

0_2_0086018D

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C6D883 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00C6D883

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0041B050

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C790B2 mov eax, dword ptr fs:[00000030h]	0_2_00C790B2
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C790F6 mov eax, dword ptr fs:[00000030h]	0_2_00C790F6
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7447C mov ecx, dword ptr fs:[00000030h]	0_2_00C7447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACF3 mov eax, dword ptr fs:[00000030h]	2_2_0041ACF3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C80AD2 GetProcessHeap,

0_2_00C80AD2

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6D883 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C6D883
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6993A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C6993A
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69A96 SetUnhandledExceptionFilter,	0_2_00C69A96
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69BC7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00C69BC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00423DCD SetUnhandledExceptionFilter,	2_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA242AF SetUnhandledExceptionFilter,	2_2_1FA242AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1FA22C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

0_2_0086018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,		2_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		2_2_004137BD

Writes to foreign memory regions

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 643000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8E5008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C6962C cpuid

0_2_00C6962C

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C7888C
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00C80870
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C801F9
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C801AE
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C80107
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C80294
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00C8031F
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C78DF2
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C80572
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00C8069B
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C807A1
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00C7FF0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1FA22112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1FA22112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FBFFF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_1FA23AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_1FC13300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12CB6

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C69834 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00C69834

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411BEC GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00411BEC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411CBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00411CBF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.56bDgH9sMQ.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.56bDgH9sMQ.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAA1FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	2_2_1FA9DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA35C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1FA35C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1FA9DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB4D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB4D9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC5910 sqlite3_mprintf,sqlite3_bind_int64,	2_2_1FAC5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAFD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAFD610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAC55B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB4D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB4D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB414D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FADD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FADD3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAC51D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	2_2_1FAB9090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA50FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1FA50FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB04D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1FB04D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA34820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	2_2_1FA34820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	2_2_1FA48680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1FA706E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA78550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	2_2_1FA78550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA98200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_1FA98200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FB037E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAE3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAE3770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	2_2_1FA4B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA7EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_1FA7EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	2_2_1FA9A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1FA366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA8E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_1FA8E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FA9E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA8E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1FA8E090

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.201.251.214	unknown	Germany		24940	HETZNER-ASDE	false
149.154.167.99	t.me	United Kingdom		62041	TELEGRAMRU	true

Contacted Domains

Name	IP	Active
t.me	149.154.167.99	true
windowsupdatebg.s.llnwi.net	87.248.205.0	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199707802586	true	Avira URL Cloud: malware	unknown
https://t.me/g067n	true	Avira URL Cloud: malware	unknown

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 56bDgH9sMQ.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "254862acdd5c5d2dddb209d751490c15"}

Multi AV Scanner detection for domain / URL

Source: https://195.201.251.214:9000/

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: 56bDgH9sMQ.exe	ReversingLabs: Detection: 78%
Source: 56bDgH9sMQ.exe	Virustotal: Detection: 81%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 56bDgH9sMQ.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Sleep
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: user32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sscanf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NtQueryInformationProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HeapFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32Next
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Process32First
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindClose
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: WriteFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetLastError
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SelectObject
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BitBlt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GdipFree
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetDC
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrStrA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmGetList
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PATH
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Soft:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: profile:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Host:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Login:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Password:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: OperaGX
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Network
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: .txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: TRUE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: FALSE
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Autofill
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: History
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Name:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Month:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Year:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Card:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Login Data
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Web Data
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: History
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: logins.json
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: usernameField
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: guid
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Plugins
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Local State
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: chrome
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: opera
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: firefox
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Wallets
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ProductName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayName
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Temp\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: .exe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: runas
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: open
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: /c start
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.lnk
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Files
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \discord\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: key_datas
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: map*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Telegram
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.tox
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: *.ini
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Password
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000001
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000002
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000003
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: 00000004
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Pidgin
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \.purple\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: token:
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: SteamPath
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \config\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ssfn*
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: config.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Steam\
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: browsers
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: done
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Soft
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: https
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: POST
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: hwid
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: build
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: token
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: file_name
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: file
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: message
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 2.2.RegAsm.exe.400000.0.unpack	String decryptor: screenshot.jpg

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree,	2_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	2_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	2_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	2_2_0040AB80

Uses 32bit PE files

Source: 56bDgH9sMQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49729 version: TLS 1.2

Source: 56bDgH9sMQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7D43A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00C7D43A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

2_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 195.201.251.214:9000

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 195.201.251.214 195.201.251.214
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: TELEGRAMRU TELEGRAMRU

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214
Source: unknown	TCP traffic detected without corresponding DNS query: 195.201.251.214

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004058C4

Source: global traffic

HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: t.me

Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabU
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 00000002.00000002.3059706010.000000001FC6D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, sqlt[1].dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/0cosoft
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/9zn
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/:9000
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/Mac
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/O
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllatch
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllffsets
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllge
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllm
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/freebl3.dllu
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/icrosoft
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/l
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dll
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dlla
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllge
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/mozglue.dllo
Source: RegAsm.exe, 00000002.00000002.3052745059.0000000001135000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dll
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dlle
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/msvcp140.dllet
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nes
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllA
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllU
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nss3.dllo
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001056000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/nzC
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dll
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllV
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dlle
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/softokn3.dllll
Source: RegAsm.exe, 00000002.00000002.3052745059.00000000010F1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/sqlt.dll
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000539000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dll
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllD
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dller
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dlls
Source: RegAsm.exe, 00000002.00000002.3052807408.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/vcruntime140.dllt
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000/y
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:900030cle
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Google
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000Microsoft
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://195.201.251.214:9000g
Source: BGDAAK.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: BGDAAK.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: BGDAAK.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3055858373.00000000196AC000.00000004.00000020.00020000.00000000.sdmp, BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3055858373.00000000196AC000.00000004.00000020.00020000.00000000.sdmp, BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: BAKFCB.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000002.00000002.3051781987.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nJt
Source: 56bDgH9sMQ.exe, 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/pjm
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000000F81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: BGDAAK.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BGDAAK.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729

Source: unknown

HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49729 version: TLS 1.2

Contains functionality to record screenshots

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_00413160

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.42e038.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth

Detected potential crypto function

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C87930	0_2_00C87930
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C73050	0_2_00C73050
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6F934	0_2_00C6F934
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C8123B	0_2_00C8123B
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C64430	0_2_00C64430
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C76DB9	0_2_00C76DB9
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C777D9	0_2_00C777D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ECEC	2_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041E919	2_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041EEC1	2_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041F6CF	2_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA34CF0	2_2_1FA34CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA212A8	2_2_1FA212A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22AA9	2_2_1FA22AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB89CC0	2_2_1FB89CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2292D	2_2_1FA2292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB49A20	2_2_1FB49A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22018	2_2_1FA22018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAD5940	2_2_1FAD5940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21C9E	2_2_1FA21C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC9690	2_2_1FAC9690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB89430	2_2_1FB89430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB53B0	2_2_1FAB53B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23580	2_2_1FA23580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FBFD209	2_2_1FBFD209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA39000	2_2_1FA39000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB45040	2_2_1FB45040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48D2A	2_2_1FA48D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB24A60	2_2_1FB24A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21EF1	2_2_1FA21EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48763	2_2_1FA48763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA84760	2_2_1FA84760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB8760	2_2_1FAB8760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48680	2_2_1FA48680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB60480	2_2_1FB60480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23AB2	2_2_1FA23AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA8120	2_2_1FAA8120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA0090	2_2_1FAA0090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB48030	2_2_1FB48030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2290A	2_2_1FA2290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4BAB0	2_2_1FA4BAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2251D	2_2_1FA2251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53370	2_2_1FA53370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2174E	2_2_1FA2174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FBFAEBE	2_2_1FBFAEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA82EE0	2_2_1FA82EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA219DD	2_2_1FA219DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2EA80	2_2_1FA2EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2AA40	2_2_1FA2AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB069C0	2_2_1FB069C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB3A900	2_2_1FB3A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB1A940	2_2_1FB1A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2481D	2_2_1FA2481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA23E3B	2_2_1FA23E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB5E800	2_2_1FB5E800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA366C0	2_2_1FA366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB1A590	2_2_1FB1A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4A560	2_2_1FA4A560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA247AF	2_2_1FA247AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAAA0B0	2_2_1FAAA0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2209F	2_2_1FA2209F

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: String function: 00C69B60 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA21C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FC006B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA2415B appears 118 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA2395E appears 78 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 1FA21F5A appears 31 times

One or more processes crash

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 324

Uses 32bit PE files

Source: 56bDgH9sMQ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 2.2.RegAsm.exe.42e038.1.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/14@5/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0041246A CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_0041246A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004129BF CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,VariantClear,

2_2_004129BF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\JFUY9M9X.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7736

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\798e780e-3e0e-4fee-afc4-0c3b6c94dd7d

Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: HDGDHC.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 00000002.00000002.3056036750.0000000019CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3059615560.000000001FC38000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.2.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 56bDgH9sMQ.exe	ReversingLabs: Detection: 78%
Source: 56bDgH9sMQ.exe	Virustotal: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\56bDgH9sMQ.exe "C:\Users\user\Desktop\56bDgH9sMQ.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7736 -s 324
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: 56bDgH9sMQ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 56bDgH9sMQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0041B050

PE file contains sections with non-standard names

Source: sqlt[1].dll.2.dr

Static PE information: section name: .00cfg

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69536 push ecx; ret	0_2_00C69549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421EF5 push ecx; ret	2_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2D3AF push ebx; ret	2_2_1FA2D3B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB97 push ebx; ret	2_2_1FA2CB98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB9E push ebx; ret	2_2_1FA2CB9F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA21BF9 push ecx; ret	2_2_1FBC4C03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB6B push ebx; ret	2_2_1FA2CB6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB7F push ebx; ret	2_2_1FA2CB82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA2CB53 push ebx; ret	2_2_1FA2CB64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA210C8 push ecx; ret	2_2_1FC23552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5322D push esp; ret	2_2_1FA5322E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA531AF push esp; ret	2_2_1FA531B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53187 push ebp; ret	2_2_1FA53188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5319A push esi; ret	2_2_1FA5319C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53125 push esp; ret	2_2_1FA53126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53164 push ebp; ret	2_2_1FA53167
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA53160 push ebp; ret	2_2_1FA53161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA5317D push ebp; ret	2_2_1FA5317E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530E8 push ebp; ret	2_2_1FA530E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530F2 push ebp; ret	2_2_1FA530F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530C7 push ebp; ret	2_2_1FA530C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA530CD push ebp; ret	2_2_1FA530CE

Drops PE files

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0041B050

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7D43A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00C7D43A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	2_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	2_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	2_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	2_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	2_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	2_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	2_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

2_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411F21 GetSystemInfo,wsprintfA,

2_2_00411F21

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareb
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2K
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000002.00000002.3052425504.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

0_2_0086018D

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C6D883 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00C6D883

Contains functionality to dynamically determine API calls

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_0041B050

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C790B2 mov eax, dword ptr fs:[00000030h]	0_2_00C790B2
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C790F6 mov eax, dword ptr fs:[00000030h]	0_2_00C790F6
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C7447C mov ecx, dword ptr fs:[00000030h]	0_2_00C7447C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0041ACF3 mov eax, dword ptr fs:[00000030h]	2_2_0041ACF3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C80AD2 GetProcessHeap,

0_2_00C80AD2

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6D883 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C6D883
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C6993A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C6993A
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69A96 SetUnhandledExceptionFilter,	0_2_00C69A96
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: 0_2_00C69BC7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00C69BC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00423DCD SetUnhandledExceptionFilter,	2_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA242AF SetUnhandledExceptionFilter,	2_2_1FA242AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA22C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_1FA22C8E

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

0_2_0086018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,		2_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		2_2_004137BD

Writes to foreign memory regions

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 425000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 643000	Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 8E5008	Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C6962C cpuid

0_2_00C6962C

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C7888C
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00C80870
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C801F9
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C801AE
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C80107
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: EnumSystemLocalesW,	0_2_00C80294
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00C8031F
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C78DF2
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C80572
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00C8069B
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetLocaleInfoW,	0_2_00C807A1
Source: C:\Users\user\Desktop\56bDgH9sMQ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00C7FF0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	2_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1FA22112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_1FA22112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FBFFF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_1FA23AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_1FC13300
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12DF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_1FC12CB6

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\56bDgH9sMQ.exe

Code function: 0_2_00C69834 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00C69834

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411BEC GetProcessHeap,HeapAlloc,GetUserNameA,

2_2_00411BEC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00411CBF GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

2_2_00411CBF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000002.00000002.3052526377.0000000001021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.56bDgH9sMQ.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Yara detected Credential Stealer

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.56bDgH9sMQ.exe.c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2087255940.0000000000C94000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3051781987.0000000000445000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 56bDgH9sMQ.exe PID: 7736, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7768, type: MEMORYSTR

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAA1FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAA1FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9DFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	2_2_1FA9DFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA35C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1FA35C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9DB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1FA9DB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB4D9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB4D9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC5910 sqlite3_mprintf,sqlite3_bind_int64,	2_2_1FAC5910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAFD610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAFD610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC55B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAC55B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB4D4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB4D4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB414D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	2_2_1FB414D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FADD3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FADD3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAC51D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAC51D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAB9090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	2_2_1FAB9090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA50FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	2_2_1FA50FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB04D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,InitOnceBeginInitialize,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	2_2_1FB04D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA34820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	2_2_1FA34820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA48680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	2_2_1FA48680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA706E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	2_2_1FA706E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA78550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	2_2_1FA78550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA98200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	2_2_1FA98200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FB037E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FB037E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FAE3770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FAE3770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA4B400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	2_2_1FA4B400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA7EF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	2_2_1FA7EF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9A6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	2_2_1FA9A6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA366C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1FA366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA8E200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	2_2_1FA8E200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA9E170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	2_2_1FA9E170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_1FA8E090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	2_2_1FA8E090

ID:	1465067
Product:	CloudBasic
Start time:	09:11:12
Start date:	01.07.2024
Sample:	56bDgH9sMQ.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f88272ea7674d3acedd8adcf7643c598
SHA1:	0066fd44e2cd9293af414f735bd80456f4e3eb1d
SHA256:	fad264acc346be1e63cd47611cd305cb9c894a13843119e22e87744808295387
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\CFIEBKEHCAKF\BAKFCB	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4	6A6BAD38068B0F6F2CADC6464C4FE8F0	4E3B235898D8E900548613DDB6EA59CDA5EB4E68	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
C:\ProgramData\CFIEBKEHCAKF\BGDAAK	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	28591AA4E12D1C4FC761BE7C0A468622	BC4968A84C19377D05A8BB3F208FBFAC49F4820B	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
C:\ProgramData\CFIEBKEHCAKF\HDGDHC	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\ProgramData\CFIEBKEHCAKF\HJDBKJ	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11	41EA9A4112F057AE6BA17E2838AEAC26	F2B389103BFD1A1A050C4857A995B09FEAFE8903	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
C:\ProgramData\CFIEBKEHCAKF\IECGHJ	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2	A2D1F4CF66465F9F0CAC61C4A95C7EDE	BA6A845E247B221AAEC96C4213E1FD3744B10A27	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
C:\ProgramData\CFIEBKEHCAKF\JECAEH	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2	780853CDDEAEE8DE70F28A4B255A600B	AD7A5DA33F7AD12946153C497E990720B09005ED	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_56bDgH9sMQ.exe_6753fc4336f189f5fb3908672f6549aff5ec85_db4f562b_8bf834f7-d476-4e10-bc4d-96a40156ebb2\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	4A7E275B6A47B23578B7379B47342F3F	9BB7758BF2F4BB42579836FED5BCC160F46406FA	52E5C4F490650EB7585B55E01AE9EC285E1D990D81F35D6EE2B4B7644523716A
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC95.tmp.dmp	Mini DuMP crash report, 14 streams, Mon Jul 1 07:12:17 2024, 0x1205a4 type	9454163361A89B5F578A2A363BCD5E1F	B9DC974D8FD7EB2203D7839A0A53F8F61CCB3D7A	898C2EA1BD7606737F3E66CA0824CDBEDD616C37160FE8CAA56C3366A87B7690
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD03.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	24C3B04D0F5B88A2818497D697D4236A	8E1B4777545F2E5DB34EF6A2532E92940CF4E616	E4932DB9DD88F879209011805F74D9995BB485E59017EAE09CC4E442DF077B27
C:\ProgramData\Microsoft\Windows\WER\Temp\WERDD43.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	96F403094D9DE84191AF86990F6B9C47	C12BC2B200C7424E251A3427FF9C22E055A5BF6B	CDC312DD464812B365D051FB93C1F12162AD12A03AC73F031ED99E0D58B72FF1
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C52E2193D5BA95BACD3E2BEE315815FA	DE4CE259195497A1B06C722458BA5525A14C70A9	165F19F8A72938B46A88F53DF01EBBA2C892F25D2AF64583AA556EE99143DDDE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlt[1].dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	90E744829865D57082A7F452EDC90DE5	833B178775F39675FA4E55EAB1032353514E1052	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	4ADACAA5D41677E9452880ABFB9C9627	1181F1F71C640FA0A5C97AEB2DD877C5584BE36B	50354B8D3F13FA6AF14578773876927AAC0BE7C02766761BD7403326379BFBE6

Windows Analysis Report
56bDgH9sMQ.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report 56bDgH9sMQ.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
56bDgH9sMQ.exe

Malware Threat Intel
Provided by