Windows Analysis Report
BDQfYL99b2.exe

AI detected suspicious sample

Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

3_2_00433837

Source: BDQfYL99b2.exe, 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_b3498c3a-c

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_004074FD _wcslen,CoGetObject,

3_2_004074FD

Source: unknown

HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:54066 version: TLS 1.2

Source: BDQfYL99b2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D56B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbean) source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb*F source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb\b) source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbu source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB41F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D5670000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\BDQfYL99b2.PDB@ source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdbW source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbp source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbes source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb0. source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D5670000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbn source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbes source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: BDQfYL99b2.PDB source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: izpC:\Users\user\Desktop\BDQfYL99b2.PDB source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0044E879 FindFirstFileExA,	3_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040783C FindFirstFileW,FindNextFileW,	3_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407C97

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: bossnacarpet.com

Source: global traffic	TCP traffic: 192.168.2.6:49710 -> 173.255.204.62:2556
Source: global traffic	TCP traffic: 192.168.2.6:49713 -> 107.173.4.18:2556

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 52.168.117.173 52.168.117.173
Source: Joe Sandbox View	IP Address: 173.255.204.62 173.255.204.62
Source: Joe Sandbox View	IP Address: 107.173.4.18 107.173.4.18
Source: Joe Sandbox View	IP Address: 107.173.4.18 107.173.4.18

Source: Joe Sandbox View	ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	TCP traffic detected without corresponding DNS query: 52.168.117.173
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_0041B380

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bossnacarpet.com
Source: global traffic	DNS traffic detected: DNS query: vegetachcnc.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: unknown

HTTP traffic detected: POST /Telemetry.Request HTTP/1.1Connection: Keep-AliveUser-Agent: MSDWMSA_DeviceTicket: t=EwCwAlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAQ7UsXLAS98HwRFo3wk0kdDuCyropDm7LcPUtYsXLo4HpHhm6MIqJTtAjlDQqRL0Q+F02xOMDg/t8gKZ0IFYAzLzMtk2bIgmmoMql8D/EALKpyBW4s5BLj2CEjNdjXTr/8aOvbHjmD7bxHla+4WffRqMlPJQazJxFHiw49AkDEzb/YqsBeEkMN3ZM7BNvzCSswFGLvnGqDNYclbAKUiGZ9AvRmILxY5JyMfa7tbWcqVafb6IxEnu90hTizP9htXZf1SlOzFT1CPeGfA78vKn4DFI48DCjyZUV7eGbKwusTlt2WtA6wdSUNOsxJcJAR2bpXpRuU2RhlLpWggzThddKaUDZgAACPWcP8PJUP0sgAEb401qTfgzav13/8m32w4Ohl2DRLF7B7r37jErtHj4ZexGVQMoudN1cGHqKrtgEFl2b0a8izrE5UhSkhREv+WJeHANYlZdedzhmtNhpw3JLw0CAvDpCkoEf20dlKhDXIp1/JeaeNo/i9pYOVxWK2GILWr8wV5kQk8eqtcaQ1mTyhpsv3MXJp/dMP+hDQBsmCJrN4AJ4ucDZ8X0pfjPDV8sxbr4K6OR4nF0WM+FRqaRQk71h2uPxik5AzzHzQJZFC2RYnAzYOpeMjzyrCMkj6GhLa4C/x/7PkgL7b6XsHrCIUSVPd2TU1x+ikS7jECZhrw9G0kAhSr6EkIDQ/B1gbWhm98fRHD7Zg6ienQpkTZq53+Cjcpvs6yviZSD/PJxG1nPmBu5W9ncXUfws+UVPeW4G7R5qGpctSr7t5oaIrd6SKoE8TLHOVka8LZ9CfnoO31zM2incLQRjoMO6nBAVWG14UGqJ+thPkOh+ujVQ3ydrJP1BLlQPmtred7bmNWean61AQ==&p=Content-Length: 4828Host: umwatson.events.data.microsoft.com

Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp.
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/
Source: BDQfYL99b2.exe, 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpG
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpal
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpc
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpr&
Source: aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpr2
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54066
Source: unknown	Network traffic detected: HTTP traffic on port 54066 -> 443

Source: unknown

HTTPS traffic detected: 52.168.117.173:443 -> 192.168.2.6:54066 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

3_2_0040A2B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

3_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

3_2_004168C1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

3_2_0040B70E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

3_2_0040A3E0

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041C9E2 SystemParametersInfoW,

3_2_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

3_2_004167B4

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34714D30	0_2_00007FFD34714D30
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34701500	0_2_00007FFD34701500
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD3470BDE9	0_2_00007FFD3470BDE9
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34708EF8	0_2_00007FFD34708EF8
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34703B18	0_2_00007FFD34703B18
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34701800	0_2_00007FFD34701800
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD347043EC	0_2_00007FFD347043EC
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD347014FD	0_2_00007FFD347014FD
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34714D89	0_2_00007FFD34714D89
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD34708F3F	0_2_00007FFD34708F3F
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD3471079A	0_2_00007FFD3471079A
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD347E00FB	0_2_00007FFD347E00FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0043E0CC	3_2_0043E0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0041F0FA	3_2_0041F0FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00454159	3_2_00454159
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00438168	3_2_00438168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_004461F0	3_2_004461F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0043E2FB	3_2_0043E2FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0045332B	3_2_0045332B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0042739D	3_2_0042739D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_004374E6	3_2_004374E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0043E558	3_2_0043E558
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00438770	3_2_00438770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_004378FE	3_2_004378FE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00433946	3_2_00433946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0044D9C9	3_2_0044D9C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00427A46	3_2_00427A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0041DB62	3_2_0041DB62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00427BAF	3_2_00427BAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00437D33	3_2_00437D33
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00435E5E	3_2_00435E5E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00426E0E	3_2_00426E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0043DE9D	3_2_0043DE9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00413FCA	3_2_00413FCA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00436FEA	3_2_00436FEA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: String function: 00434E10 appears 54 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: String function: 00402093 appears 50 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: String function: 00434770 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: String function: 00401E65 appears 34 times

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1064

Source: BDQfYL99b2.exe

Static PE information: No import functions for PE file found

Source: BDQfYL99b2.exe, 00000000.00000000.2104241148.00000205BB1EC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAtakacipaxelubigetoD vs BDQfYL99b2.exe
Source: BDQfYL99b2.exe, 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOtodinedexop: vs BDQfYL99b2.exe
Source: BDQfYL99b2.exe	Binary or memory string: OriginalFilenameAtakacipaxelubigetoD vs BDQfYL99b2.exe

Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: BDQfYL99b2.exe, ----------.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbu
Source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB41F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@5/6@3/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

3_2_00417952

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

3_2_0040F474

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

3_2_0041B4A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3704:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1596
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Mutant created: \Sessions\1\BaseNamedObjects\chrome-6W1HCC

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\aef5ed17-6ce2-43e8-95e4-1841ea2751b4

Source: BDQfYL99b2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: BDQfYL99b2.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: BDQfYL99b2.exe

ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

File read: C:\Users\user\Desktop\BDQfYL99b2.exe

Source: unknown	Process created: C:\Users\user\Desktop\BDQfYL99b2.exe "C:\Users\user\Desktop\BDQfYL99b2.exe"
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1596 -s 1064
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Delayed program exit found

Source: BDQfYL99b2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: BDQfYL99b2.exe

Static file information: File size 3397673 > 1048576

Source: BDQfYL99b2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: BDQfYL99b2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D56B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbean) source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb*F source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb\b) source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbu source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB41F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Users\user\Desktop\.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D5670000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\BDQfYL99b2.PDB@ source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdbW source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbp source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbes source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB42C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb0. source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: BDQfYL99b2.exe, 00000000.00000002.2169832312.00000205D5670000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdbn source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbes source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: BDQfYL99b2.exe, 00000000.00000002.2165556949.00000205BB39D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: BDQfYL99b2.PDB source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER4E1.tmp.dmp.6.dr
Source:	Binary string: izpC:\Users\user\Desktop\BDQfYL99b2.PDB source: BDQfYL99b2.exe, 00000000.00000002.2164969522.0000007A698F2000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041CB50 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

3_2_0041CB50

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD347059D5 push ds; retn 0008h	0_2_00007FFD347059D6
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Code function: 0_2_00007FFD347E00FB push esp; retf 4810h	0_2_00007FFD347E0312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00457106 push ecx; ret	3_2_00457119
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0045B11A push esp; ret	3_2_0045B141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0045E54D push esi; ret	3_2_0045E556
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00457A28 push eax; ret	3_2_00457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00434E56 push ecx; ret	3_2_00434E69

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00406EB0 ShellExecuteW,URLDownloadToFileW,

3_2_00406EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

3_2_0041AA4A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

3_2_0041CB50

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0040F7A7 Sleep,ExitProcess,

3_2_0040F7A7

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory allocated: 205BB530000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory allocated: 205D4DD0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

3_2_0041A748

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Window / User API: threadDelayed 9677

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe TID: 4208	Thread sleep count: 315 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe TID: 4208	Thread sleep time: -945000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe TID: 4208	Thread sleep count: 9677 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe TID: 4208	Thread sleep time: -29031000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409253
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	3_2_0041C291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	3_2_0040C34D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	3_2_00409665
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0044E879 FindFirstFileExA,	3_2_0044E879
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	3_2_0040880C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040783C FindFirstFileW,FindNextFileW,	3_2_0040783C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	3_2_00419AF5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	3_2_0040BD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

3_2_00407C97

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: aspnet_wp.exe, 00000003.00000003.2173688836.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: aspnet_wp.exe, 00000003.00000003.2173688836.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: BDQfYL99b2.exe, 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

API call chain: ExitProcess graph end node

graph_3-48649

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_004349F9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

3_2_0041CB50

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_004432B5 mov eax, dword ptr fs:[00000030h]

3_2_004432B5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00412077 GetProcessHeap,HeapFree,

3_2_00412077

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_004349F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00434B47 SetUnhandledExceptionFilter,	3_2_00434B47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0043BB22
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: 3_2_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00434FDC

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Memory allocated: page read and write | page guard

.NET source code references suspicious native API functions

HIPS / PFW / Operating System Protection Evasion

Source: BDQfYL99b2.exe, ----------.cs	Reference to suspicious API methods: GetProcAddress(_EC76_EE96_EC7C_EEF9_EE2B_EC8E_EE75_08F2_06FE_ECA8, _065F_EE5D_ECA9_08E6_08FF_EE72)
Source: BDQfYL99b2.exe, ----------.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)_08EA_ECA7_EEB7_08D8_0610_EE34.Length, 64u, out var _EE22_EE28_ECBC_EE75_EE52_060F_EE7E_0654_EEC0_08DB_0618_08DE_ECBF)
Source: BDQfYL99b2.exe, ----------.cs	Reference to suspicious API methods: LoadLibrary(_EE16_EE09_EE00_EE19_0E7C_EE4F_EE1C_060B_EEC8_EE24_EC73_EE87_EC73_EE3F_0E6B(_EC8E_EE42_ECBE_EECA_EECE_EE15_EE77_EE88_06DC_0EBB_ECA9_EE7E_EE24_EE50._EE53_EE0A))

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 459000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 471000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 477000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 478000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 479000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 47E000	Jump to behavior
Source: C:\Users\user\Desktop\BDQfYL99b2.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe base: 4BF4008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

3_2_004120F7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00419627 mouse_event,

3_2_00419627

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"

Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager&
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managero
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerj
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager2
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager`
Source: aspnet_wp.exe, 00000003.00000002.4567891787.0000000004F07000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EF0000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00434C52 cpuid

3_2_00434C52

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoA,	3_2_0040F8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: EnumSystemLocalesW,	3_2_00452036
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_004520C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoW,	3_2_00452313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: EnumSystemLocalesW,	3_2_00448404
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0045243C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoW,	3_2_00452543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00452610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: GetLocaleInfoW,	3_2_004488ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_00451CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: EnumSystemLocalesW,	3_2_00451F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: EnumSystemLocalesW,	3_2_00451F9B

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Queries volume information: C:\Users\user\Desktop\BDQfYL99b2.exe VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00404F51 GetLocalTime,CreateEventA,CreateThread,

3_2_00404F51

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_0041B60D GetComputerNameExW,GetUserNameW,

3_2_0041B60D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: 3_2_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

3_2_00449190

Source: C:\Users\user\Desktop\BDQfYL99b2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

3_2_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		3_2_0040BB30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe	Code function: \key3.db		3_2_0040BB30

Remote Access Functionality

Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.aspnet_wp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3fddf0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd3851a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.BDQfYL99b2.exe.205cd2b8770.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BDQfYL99b2.exe PID: 1596, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: aspnet_wp.exe PID: 4616, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Code function: cmd.exe

3_2_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	12 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 DLL Side-Loading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	322 Process Injection	1 Bypass User Account Control	LSA Secrets	33 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	322 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BDQfYL99b2.exe	34%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
bossnacarpet.com	100%	Avira URL Cloud	malware
http://geoplugin.net/json.gpal	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpr2	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpG	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpc	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpl	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpr&	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp.	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vegetachcnc.com	107.173.4.18	true	true	unknown
bossnacarpet.com	173.255.204.62	true	true	unknown
geoplugin.net	178.237.33.50	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
bossnacarpet.com	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gpal	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpc	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpG	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	BDQfYL99b2.exe, 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gpl	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp, aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpr&	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpr2	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/	aspnet_wp.exe, 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp.	aspnet_wp.exe, 00000003.00000003.2173592542.0000000004EE6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.168.117.173	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
173.255.204.62	bossnacarpet.com	United States	63949	LINODE-APLinodeLLCUS	true
107.173.4.18	vegetachcnc.com	United States	36352	AS-COLOCROSSINGUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467126
Start date and time:	2024-07-03 18:22:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BDQfYL99b2.exe renamed because original name is a hash value
Original Sample Name:	a2dcc2e9dd81e3a5f6440ed7027a86da.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@5/6@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 82% Number of executed functions: 53 Number of non-executed functions: 191
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: BDQfYL99b2.exe

Simulations

Behavior and APIs

Time	Type	Description
12:23:52	API Interceptor	1x Sleep call for process: WerFault.exe modified
12:24:25	API Interceptor	4909453x Sleep call for process: aspnet_wp.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.168.117.173	SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
	E5440A24.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.BackDoor.SpyBotNET.62.21177.12908.exe	Get hash	malicious	EICAR, PureLog Stealer, zgRAT	Browse
	payment.pdf.exe	Get hash	malicious	Apollo Agent	Browse
	DHL- CBJ520818836689.exe	Get hash	malicious	Unknown	Browse
	XmlPad-Installer_273425.exe	Get hash	malicious	Unknown	Browse
	Shift - Recipes_spn7g.exe	Get hash	malicious	Unknown	Browse
	https://eu-central.storage.cloudconvert.com/tasks/004d6e18-5b09-432f-ae9a-7d0bef441692/%40%21Pa%20sc0d%C3%A9__-NewFiLes.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=cloudconvert-production%2F20240531%2Ffra%2Fs3%2Faws4_request&X-Amz-Date=20240531T054225Z&X-Amz-Expires=86400&X-Amz-Signature=e44f950daf1a1a2004947d6b8b5f8aa77838142684691288964d6f5027abcb41&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22%40%21Pa%20sc0d%C3%A9__-NewFiLes.zip%22&response-content-type=application%2Fzip&x-id=GetObject	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.26431.15713.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse
	1cEhV3HjIY.exe	Get hash	malicious	Unknown	Browse
173.255.204.62	Quotation.xls	Get hash	malicious	Remcos	Browse
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse
	Quotation.xls	Get hash	malicious	Remcos	Browse
	alr9GXGR1j.dll	Get hash	malicious	Unknown	Browse
	Opdopbsaed.dll.dll	Get hash	malicious	Unknown	Browse
	Inquiry[2023.10.11_08-07].vbs	Get hash	malicious	IcedID	Browse
	DOCUMENT[2023.10.11_08-07]_2.vbs	Get hash	malicious	IcedID	Browse
	Document[2023.10.11_08-07]_1.vbs	Get hash	malicious	IcedID	Browse
	information[2023.10.11_08-07]_2.vbs	Get hash	malicious	IcedID	Browse
	Document[2023.10.11_08-07].vbs	Get hash	malicious	IcedID	Browse
107.173.4.18	PO_CEE-2340975.xls	Get hash	malicious	Unknown	Browse	107.173.4.18/800/audiodgse.exe
	Purchase_Order_9000011644.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/220/audiodgse.exe
	order_sheet.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/230/audiodgse.exe
	PO-210.xls	Get hash	malicious	Unknown	Browse	107.173.4.18/210/sihost.exe
	SOA.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/200/sihost.exe
	PO#SWASA2200157.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/170/sihost.exe
	SISF23208BP_1.xls	Get hash	malicious	Unknown	Browse	107.173.4.18/180/sihost.exe
	Shipping_bill_documents.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/154/ishost.exe
	PO-58101.xls	Get hash	malicious	AgentTesla	Browse	107.173.4.18/160/ishost.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
vegetachcnc.com	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.4.18
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.4.18
bossnacarpet.com	Quotation.xls	Get hash	malicious	Remcos	Browse	173.255.204.62
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	173.255.204.62
	Quotation.xls	Get hash	malicious	Remcos	Browse	173.255.204.62
	3tBnHytMM4.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.4.18
	mkHTu6LjYc.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.4.18
	qkAfLpWvQu.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	Quotation.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	Shipping Document.P.df.exe	Get hash	malicious	PrivateLoader, Remcos	Browse	107.173.4.18
geoplugin.net	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	Payment Advice__Swift-MT103.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	UniCredit__Avviso di Pagamento.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172001946670b1e83321a2b0b2afa526495dda6118492d61c1dbccf1f24b87b00c0e2fc524979.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	wcNDx6MT9O.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	cnaniAxghZ.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	xBkOubR0eL.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO#2195112.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	TT_Payment_Slip.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	Quotation.xls	Get hash	malicious	Remcos	Browse	173.255.204.62
	https://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDA	Get hash	malicious	Unknown	Browse	45.33.29.14
	https://lnkd.in/e4hHCn_z	Get hash	malicious	HTMLPhisher	Browse	173.255.231.96
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CxFHH8i5A3U7lzl-2BTzhlR6ei7mav1762I-2BKvT-2Fk6a5kLUgUMy5HF64b8WrTGY5vFuTce1vV41Ab4MyQrOplI7tU5VMylICgXEGMOcA3lDJVs2-2BVa-2BmXMPQdZkUiKRaSMtyb23BSU13fAy94eMgbbpWGHvMycQlWPfPxKMDzYSeE5kVyJwAD8pphYTNvERMYMmCwKiJ4MAAmjiqW4JLB-2FG-2FQ-3D-3D7yf0_p4A4YQt8epDIK9HlKea9sV-2FOtqGPyWoKM4LjM22Z6dbxuq3iGRjCzJ5YebtyuIEIvPEZ2Hi95MwGR7xtnodhDM8Iaj1NIu5u9A6c7A4CmoLtPLA1AYBR71m8begekekKFtQMeZCPuBYlMudBl33wvV-2Fu39N8kuAyCAOxmPkHrWSpXaxCDYANLX8xWXDor5baRk0uk-2FQ6kftnlL1vkLQkwQ-3D-3D	Get hash	malicious	Unknown	Browse	50.116.55.211
	https://lnkd.in/e7UhDEpW	Get hash	malicious	HTMLPhisher	Browse	96.126.106.143
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	178.79.169.182
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	178.79.169.182
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	178.79.169.182
	94.156.79.133-mips-2024-07-01T19_26_38.elf	Get hash	malicious	Mirai, Gafgyt	Browse	139.162.103.222
	List of Required items and services.zip	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	139.162.152.24
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://eplogisticademexico-my.sharepoint.com/personal/natalyar_eplogistics_com1/_layouts/15/guestaccess.aspx?e=5%3aIF7Pg7&at=9&share=ElyrWNLgmPNHoLatr5CK5xABy6AUzd-VUKQ5lFH-DHWgkA	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://eplogisticademexico-my.sharepoint.com/personal/natalyar_eplogistics_com1/_layouts/15/guestaccess.aspx?e=5%3aIF7Pg7&at=9&share=ElyrWNLgmPNHoLatr5CK5xABy6AUzd-VUKQ5lFH-DHWgkA	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://m.exactag.com/ai.aspx?tc=d9550673bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41tuskerdigital.com%2Fwinner%2F24968%2F%2FdHJ1bXBzdWNrc2RpY2tAbWFpbC5ydQ==	Get hash	malicious	HTMLPhisher	Browse	40.126.32.136
	https://url.us.m.mimecastprotect.com/s/GSubCpYn1pC4mvoJtD-hLP?domain=brileyfinancial-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse	52.104.113.41
	https://isothermcx-my.sharepoint.com/:o:/p/m_chiasson/EldSmlva1OBFixvWpubo0mgB0DZQ4Do42riWb9YO1XmP-g?e=5%3av4rvfI&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	https://www.filemail.com/t/RuKZYfeB	Get hash	malicious	HTMLPhisher	Browse	20.82.124.160
	https://m.exactag.com/ai.aspx?tc=d9177038bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Atheannapolis250.org%2Fwinner%2F14136%2F%2FYnJhbndlbGwubW9mZmF0QGtwcy5jb20=	Get hash	malicious	HTMLPhisher	Browse	52.98.243.18
	Quarantined Messages (1).zip	Get hash	malicious	HTMLPhisher	Browse	52.109.28.46
	https://kdftoiturescom.sharepoint.com/:f:/s/Public/EiJsAXrCZntIvTidUnkdk68B9BO58WCESI-JRSxpXut8mQ?e=5%3aDy13C9&at=9&xsdata=MDV8MDJ8bW5hZGVhdTJAc3FpLmdvdXYucWMuY2F8MTFlZGY3MWU5M2M0NDBjZTRmYzEwOGRjOWFjYmM5MjZ8YzRjZWI1N2Y3ZGY3NDFkMThiOTdhODUwNDhiOGU5NWV8MHwwfDYzODU1NTQ0NzI1ODU2Nzg2NnxVbmtub3dufFRXRnBiR1pzYjNkOGV5SldJam9pTUM0d0xqQXdNREFpTENKUUlqb2lWMmx1TXpJaUxDSkJUaUk2SWsxaGFXd2lMQ0pYVkNJNk1uMD18MHx8fA%3d%3d&sdata=ZnAvNUFualYyN0tLODVxUFB1eTNHc3hVNWNPU05tK1g1VzQxZ2xJMlhnOD0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMTc1MzEuMjAxOTAiLCAiT1MiIDogIldpbmRvd3MiIH0%3D	Get hash	malicious	HTMLPhisher	Browse	104.47.75.156
	https://lnkd.in/exwPeXjc	Get hash	malicious	HTMLPhisher	Browse	13.107.42.14
AS-COLOCROSSINGUS	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	107.174.145.78
	Quotation.xls	Get hash	malicious	Remcos	Browse	107.173.4.18
	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	Get hash	malicious	AgentTesla	Browse	198.46.178.144
	Ship particulars.xls	Get hash	malicious	Unknown	Browse	198.46.178.139
	wcNDx6MT9O.exe	Get hash	malicious	Remcos	Browse	107.173.4.16
	cnaniAxghZ.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	execute_and_cleanup.sh	Get hash	malicious	Unknown	Browse	108.174.58.28
	4YlwTsmpuZ.rtf	Get hash	malicious	Unknown	Browse	23.95.235.16
	Payment_Advice.xls	Get hash	malicious	Unknown	Browse	192.3.179.150
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	23.95.235.16
ATOM86-ASATOM86NL	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	Payment Advice__Swift-MT103.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	UniCredit__Avviso di Pagamento.pdf.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	file.exe	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	172001946670b1e83321a2b0b2afa526495dda6118492d61c1dbccf1f24b87b00c0e2fc524979.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	wcNDx6MT9O.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	cnaniAxghZ.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	xBkOubR0eL.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	PO#2195112.vbs	Get hash	malicious	Remcos	Browse	178.237.33.50
	TT_Payment_Slip.bat.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	7EulSGn18e.exe	Get hash	malicious	LummaC	Browse	52.168.117.173
	NSLC_Billing_Document_No_0240255100.html	Get hash	malicious	CVE-2024-21412	Browse	52.168.117.173
	d8gZVaN0ms.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, Stealc, Vidar	Browse	52.168.117.173
	Adjunto confirmacion de pedido.exe	Get hash	malicious	DBatLoader, FormBook	Browse	52.168.117.173
	ZAM#U00d3WIENIE Nr.240702117398203XLS.exe	Get hash	malicious	DBatLoader, FormBook	Browse	52.168.117.173
	#U8f6e#U6905-#U89c4#U683c2024#U5e747#U67081.docx.pif.exe	Get hash	malicious	Remcos, DBatLoader	Browse	52.168.117.173
	pago pendientes.xls	Get hash	malicious	Unknown	Browse	52.168.117.173
	fechas de pago.xls	Get hash	malicious	Unknown	Browse	52.168.117.173
	457525.xls	Get hash	malicious	Unknown	Browse	52.168.117.173
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	52.168.117.173

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BDQfYL99b2.exe_7bbe5769bc74a17327a538bebd597bc1fc5fff7_5d7df1a8_a3bb7f14-0094-4484-b8c1-c1187a5af28d\Report.wer

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0511747411361483
Encrypted:	false
SSDEEP:	192:RuygQ0Ack+i0VeWphaWxey+XfzuiFfZ24lO8K:yQ0AcpVBphaGkXfzuiFfY4lO8K
MD5:	FD0C40B2B490389351EEFBE876BEE3D3
SHA1:	645F9901924B50217ADFEF471134F51499EA10AC
SHA-256:	FE7B5B8877B2009AD86C4BB21275A0C698386F6CF6B199DB3B04117EB2816ACD
SHA-512:	E74F1A99DE1257FF1E766E2ADEA3B5C6CB4C812364C755AAE8DC9F1C2E21A306C40EE1CEF152978154FC23700B725331AE915F299F87E558F65728C2BBAC4B62
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.4.9.7.4.2.9.4.0.2.6.6.9.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.4.9.7.4.3.0.1.3.7.0.5.0.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.b.b.7.f.1.4.-.0.0.9.4.-.4.4.8.4.-.b.8.c.1.-.c.1.1.8.7.a.5.a.f.2.8.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.0.7.c.b.5.0.1.-.c.1.f.3.-.4.2.9.a.-.9.7.5.c.-.8.5.c.a.e.e.6.1.7.c.0.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.B.D.Q.f.Y.L.9.9.b.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.t.a.k.a.c.i.p.a.x.e.l.u.b.i.g.e.t.o.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.3.c.-.0.0.0.1.-.0.0.1.5.-.a.0.c.2.-.2.6.6.1.6.5.c.d.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.2.a.5.3.c.2.9.0.3.7.b.7.5.1.f.4.8.0.7.3.b.6.8.f.a.f.8.5.f.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.3.5.1.8.e.3.3.0.e.f.6.c.6.8.2.4.4.5.b.e.d.8.1.d.6.a.e.4.e.1.6.7.b.0.0.3.a.e.4.b.!.B.D.Q.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E1.tmp.dmp

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Wed Jul 3 16:23:49 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	418192
Entropy (8bit):	3.330822188410937
Encrypted:	false
SSDEEP:	3072:JyG1+l8W0u82FLcm1CCq6Fv3+vn+D8m4lIVxzcSk:JyGcbq6Fv3Q+oad
MD5:	B6211397D3D69378C173C9255029CC8C
SHA1:	3966A41D0316B86CEA5C31FEE97C72DB1D19A5D1
SHA-256:	18478EBA40FE051B5EFD2E4D85DE3E7A4A393EE85E129147B7E90079794CFB31
SHA-512:	49C7D72F5E6B69B88F2157E0FE1575ED8A2A5CA2A330E9628388862B862BCA41928AA77CB9392CE62A422E0FB669B759CF51B12CB7D8FDFD5A887B9B737E7018
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........{.f........................D...........$...H...........l........H...w..........l.......8...........T............)...7...........9..........t;..............................................................................eJ.......<......Lw......................T.......<....{.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER697.tmp.WERInternalMetadata.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8818
Entropy (8bit):	3.710969356968757
Encrypted:	false
SSDEEP:	192:R6l7wVeJWSb6Y2D3igmfZLH0oprH89bZB0f0snzm:R6lXJbb6Yqigmf1kZifk
MD5:	6EDD64963A6E0D88198F598499E8630A
SHA1:	B2C752385CB8E633B2F9408959029282FD43D915
SHA-256:	7AB2E6971B84137BED1E6A13D4B59269176693617FC33E7B063F63217F2272C0
SHA-512:	B5BCFB52C59262DFE9140113E25B91C181C6B92A5AFA99F5BD6DD1C2C15FC70EEDE078B3613EA371BB0ADD88FA9667D22FDEB0F3286BF4934EC8219EF7C33801
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C7.tmp.xml

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4824
Entropy (8bit):	4.518270633933075
Encrypted:	false
SSDEEP:	48:cvIwWl8zsNXJg771I9FSWpW8VYZvYm8M4J382EE6Fwfjyq8vo2EEk1E8tNCd:uIjfzI7yz7VVJ/JPjW7JkyECd
MD5:	53772D61CDC003CBABE25228734A1CEB
SHA1:	CFF704D712FCBB3E2F6ED912A824CFBCF70DE220
SHA-256:	9D993EA560E32F8F6525A2260693622C3895D4E9A27580C3327BA4D63E06D6C7
SHA-512:	DE8993A7E5B8F23D87A4670D92BA38682517668F5F7246B4E7A4223A98A18D7EA45C0217BBFF33C86C56F1A7A8A5E7E0247AD60C8A273C12AB7160ECD41DDEDF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="395006" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.013811273052389
Encrypted:	false
SSDEEP:	12:tklu+mnd6CsGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkk:qlu+KdRNuKyGX85jvXhNlT3/7AcV9Wro
MD5:	18BC6D34FABB00C1E30D98E8DAEC814A
SHA1:	D21EF72B8421AA7D1F8E8B1DB1323AA93B884C54
SHA-256:	862D5523F77D193121112B15A36F602C4439791D03E24D97EF25F3A6CBE37ED0
SHA-512:	8DF14178B08AD2EDE670572394244B5224C8B070199A4BD851245B88D4EE3D7324FC7864D180DE85221ADFBBCAACB9EE9D2A77B5931D4E878E27334BF8589D71
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"1ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Windows\appcompat\Programs\Amcache.hve

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469059449419846
Encrypted:	false
SSDEEP:	6144:EzZfpi6ceLPx9skLmb0fuZWSP3aJG8nAgeiJRMMhA2zX4WABluuNjjDH5S:qZHtuZWOKnMM6bFpBj4
MD5:	CB113A058142B521BF1A606A4A46DBDD
SHA1:	17F5E38DDBFB66CFFD616BA980385716EBDAD967
SHA-256:	A61E186E7B893024388B9CFE8042CF6F40BA9F058BD183C08627E7ADBD12DA5B
SHA-512:	78961EBFFA4839D8A090BDBD929FCFCCACBB2903F153D277913C67DDE51FBD8E5713BC479021F5F8CE58125CA348E2938740D005C991C34205FE02597949B925
Malicious:	false
Reputation:	low
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.,.be.................................................................................................................................................................................................................................................................................................................................................V........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.854329136763004
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	BDQfYL99b2.exe
File size:	3'397'673 bytes
MD5:	a2dcc2e9dd81e3a5f6440ed7027a86da
SHA1:	3518e330ef6c682445bed81d6ae4e167b003ae4b
SHA256:	3521381fadca86cfc577e8aa81ecff5f3453102559bb7e86d903d9b87db1456c
SHA512:	974da06cf41da5d6e65bf834394ec0e478df55745c922cc7d5b3f8ec6501b1dff5a0b866b8c53c01519f53bee1bf7aeec54e1e6515b105d24f7f5c4a2ec97d9e
SSDEEP:	24576:Q785OVnJmAZaTGTFh98WK3vFLkjKsxnerYU:958BI0FhiKj7nerYU
TLSH:	BAF52209B7871E63FD584979D9D232F886FCEE63B0F6A68FEF815C62855A53C4210270
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....X.f.........."...0.................. ....@...... ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66845801 [Tue Jul 2 19:41:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x94c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa180	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x821a	0x8400	d15bce266203201bcde836781e36d6bf	False	0.6218039772727273	data	6.401224493840407	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x94c	0xa00	d9e50c9bae0ee9db8a337b6b80e0e56e	False	0.3015625	data	4.34200337006138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0b8	0x354	data			0.49295774647887325
RT_VERSION	0xc40c	0x354	data	English	United States	0.49295774647887325
RT_MANIFEST	0xc760	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:23:49.840590000 CEST	49710	2556	192.168.2.6	173.255.204.62
Jul 3, 2024 18:23:49.854367018 CEST	2556	49710	173.255.204.62	192.168.2.6
Jul 3, 2024 18:23:49.854459047 CEST	49710	2556	192.168.2.6	173.255.204.62
Jul 3, 2024 18:23:49.860152960 CEST	49710	2556	192.168.2.6	173.255.204.62
Jul 3, 2024 18:23:49.888123989 CEST	2556	49710	173.255.204.62	192.168.2.6
Jul 3, 2024 18:23:51.273969889 CEST	2556	49710	173.255.204.62	192.168.2.6
Jul 3, 2024 18:23:51.274060965 CEST	49710	2556	192.168.2.6	173.255.204.62
Jul 3, 2024 18:23:51.274408102 CEST	49710	2556	192.168.2.6	173.255.204.62
Jul 3, 2024 18:23:51.279272079 CEST	2556	49710	173.255.204.62	192.168.2.6
Jul 3, 2024 18:23:51.669696093 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:51.674642086 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:51.674725056 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:51.679076910 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:51.684470892 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.162998915 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.207493067 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:52.296348095 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.300503016 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:52.305525064 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.305586100 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:52.310734034 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.310791016 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:52.315608978 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.470298052 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:52.470334053 CEST	443	54066	52.168.117.173	192.168.2.6
Jul 3, 2024 18:23:52.470411062 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:52.472063065 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:52.472079992 CEST	443	54066	52.168.117.173	192.168.2.6
Jul 3, 2024 18:23:52.751934052 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.753418922 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:52.758658886 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.848371029 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:52.894923925 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:53.056610107 CEST	443	54066	52.168.117.173	192.168.2.6
Jul 3, 2024 18:23:53.056679964 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:53.061501980 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:53.061516047 CEST	443	54066	52.168.117.173	192.168.2.6
Jul 3, 2024 18:23:53.061996937 CEST	443	54066	52.168.117.173	192.168.2.6
Jul 3, 2024 18:23:53.113693953 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:53.118166924 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:53.119170904 CEST	54066	443	192.168.2.6	52.168.117.173
Jul 3, 2024 18:23:53.472390890 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:23:53.479872942 CEST	80	54068	178.237.33.50	192.168.2.6
Jul 3, 2024 18:23:53.482372999 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:23:53.482587099 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:23:53.487611055 CEST	80	54068	178.237.33.50	192.168.2.6
Jul 3, 2024 18:23:54.099636078 CEST	80	54068	178.237.33.50	192.168.2.6
Jul 3, 2024 18:23:54.099714994 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:23:54.125747919 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:23:54.130959034 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:23:55.099380016 CEST	80	54068	178.237.33.50	192.168.2.6
Jul 3, 2024 18:23:55.099503040 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:24:17.058356047 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:24:17.060362101 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:24:17.065490961 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:24:47.103502035 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:24:47.105113983 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:24:47.111633062 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:25:17.168597937 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:25:17.170353889 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:25:17.185528040 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:25:43.410823107 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:25:43.723113060 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:25:44.332531929 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:25:45.535626888 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:25:47.213154078 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:25:47.214498043 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:25:47.219316959 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:25:47.941899061 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:25:52.754394054 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:26:02.363795996 CEST	54068	80	192.168.2.6	178.237.33.50
Jul 3, 2024 18:26:17.200203896 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:26:17.201591015 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:26:17.208736897 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:26:47.242168903 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:26:47.243578911 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:26:47.248769999 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:27:17.271544933 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:27:17.272944927 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:27:17.295492887 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:27:47.321290016 CEST	2556	49713	107.173.4.18	192.168.2.6
Jul 3, 2024 18:27:47.322837114 CEST	49713	2556	192.168.2.6	107.173.4.18
Jul 3, 2024 18:27:47.328975916 CEST	2556	49713	107.173.4.18	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:23:49.541173935 CEST	50565	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:23:49.805603027 CEST	53	50565	1.1.1.1	192.168.2.6
Jul 3, 2024 18:23:51.293663979 CEST	65110	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:23:51.668421984 CEST	53	65110	1.1.1.1	192.168.2.6
Jul 3, 2024 18:23:51.982155085 CEST	53	58087	1.1.1.1	192.168.2.6
Jul 3, 2024 18:23:53.457401037 CEST	52501	53	192.168.2.6	1.1.1.1
Jul 3, 2024 18:23:53.468405962 CEST	53	52501	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:23:49.541173935 CEST	192.168.2.6	1.1.1.1	0x35f1	Standard query (0)	bossnacarpet.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:23:51.293663979 CEST	192.168.2.6	1.1.1.1	0x69d1	Standard query (0)	vegetachcnc.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:23:53.457401037 CEST	192.168.2.6	1.1.1.1	0x9e9f	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:23:49.805603027 CEST	1.1.1.1	192.168.2.6	0x35f1	No error (0)	bossnacarpet.com	173.255.204.62	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:23:51.668421984 CEST	1.1.1.1	192.168.2.6	0x69d1	No error (0)	vegetachcnc.com	107.173.4.18	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:23:53.468405962 CEST	1.1.1.1	192.168.2.6	0x9e9f	No error (0)	geoplugin.net	178.237.33.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

umwatson.events.data.microsoft.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	54068	178.237.33.50	80	4616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:23:53.482587099 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 3, 2024 18:23:54.099636078 CEST	1170	IN	HTTP/1.1 200 OK date: Wed, 03 Jul 2024 16:23:54 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 31 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"1ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	54066	52.168.117.173	443	3896	C:\Windows\System32\WerFault.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 16:23:53 UTC	1087	OUT	POST /Telemetry.Request HTTP/1.1 Connection: Keep-Alive User-Agent: MSDW MSA_DeviceTicket: t=EwCwAlN5BAAUIUShNzVa+rgHy/M+tY/dQyCg+nEAAQ7UsXLAS98HwRFo3wk0kdDuCyropDm7LcPUtYsXLo4HpHhm6MIqJTtAjlDQqRL0Q+F02xOMDg/t8gKZ0IFYAzLzMtk2bIgmmoMql8D/EALKpyBW4s5BLj2CEjNdjXTr/8aOvbHjmD7bxHla+4WffRqMlPJQazJxFHiw49AkDEzb/YqsBeEkMN3ZM7BNvzCSswFGLvnGqDNYclbAKUiGZ9AvRmILxY5JyMfa7tbWcqVafb6IxEnu90hTizP9htXZf1SlOzFT1CPeGfA78vKn4DFI48DCjyZUV7eGbKwusTlt2WtA6wdSUNOsxJcJAR2bpXpRuU2RhlLpWggzThddKaUDZgAACPWcP8PJUP0sgAEb401qTfgzav13/8m32w4Ohl2DRLF7B7r37jErtHj4ZexGVQMoudN1cGHqKrtgEFl2b0a8izrE5UhSkhREv+WJeHANYlZdedzhmtNhpw3JLw0CAvDpCkoEf20dlKhDXIp1/JeaeNo/i9pYOVxWK2GILWr8wV5kQk8eqtcaQ1mTyhpsv3MXJp/dMP+hDQBsmCJrN4AJ4ucDZ8X0pfjPDV8sxbr4K6OR4nF0WM+FRqaRQk71h2uPxik5AzzHzQJZFC2RYnAzYOpeMjzyrCMkj6GhLa4C/x/7PkgL7b6XsHrCIUSVPd2TU1x+ikS7jECZhrw9G0kAhSr6EkIDQ/B1gbWhm98fRHD7Zg6ienQpkTZq53+Cjcpvs6yviZSD/PJxG1nPmBu5W9ncXUfws+UVPeW4G7R5qGpctSr7t5oaIrd6SKoE8TLHOVka8LZ9CfnoO31zM2incLQRjoMO6nBAVWG14UGqJ+thPkOh+ujVQ3ydrJP1BLlQPmtred7bmNWean61AQ==&p= Content-Length: 4828 Host: umwatson.events.data.microsoft.com

Target ID:	0
Start time:	12:23:46
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\BDQfYL99b2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BDQfYL99b2.exe"
Imagebase:	0x205bb1e0000
File size:	3'397'673 bytes
MD5 hash:	A2DCC2E9DD81E3A5F6440ED7027A86DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2165993017.00000205BCE10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2167087771.00000205CD11F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	12:23:46
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	12:23:48
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
Imagebase:	0x1e0000
File size:	40'880 bytes
MD5 hash:	EF2DCDFF05E9679F8D0E2895D9A2E3BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000003.00000002.4567402427.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000003.00000002.4567891787.0000000004EA8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Target ID:	6
Start time:	12:23:49
Start date:	03/07/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1596 -s 1064
Imagebase:	0x7ff79aad0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true