Edit tour

Windows Analysis Report
Bankcopyscanneddoc.exe

Overview

General Information

Sample name:	Bankcopyscanneddoc.exe
Analysis ID:	1482847
MD5:	901969f80acf800e522c7e2e73840e22
SHA1:	de89bca939c5674b3afca2eaa34f2e578b3f9c84
SHA256:	f03d12cadb70aa5f2d93285bf541f8a02e4fe24c574d7eb5062c693cfb6fc076
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Bankcopyscanneddoc.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\Bankcopyscanneddoc.exe" MD5: 901969F80ACF800E522C7E2E73840E22)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["84.38.129.21:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Bankcopyscanneddoc.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1250760554.0000000000712000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bankcopyscanneddoc.exe PID: 6312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bankcopyscanneddoc.exe PID: 6312	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Bankcopyscanneddoc.exe.710000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 84.38.129.21 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:12:08.384450+0200
SID:	2046056
Source Port:	1912
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 84.38.129.21

Timestamp:	2024-07-26T09:12:08.206533+0200
SID:	2043231
Source Port:	49699
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:12:20.036450+0200
SID:	2022930
Source Port:	443
Destination Port:	49701
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.7 - Destination IP: 84.38.129.21

Timestamp:	2024-07-26T09:12:02.655038+0200
SID:	2046045
Source Port:	49699
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 84.38.129.21

Timestamp:	2024-07-26T09:12:11.875496+0200
SID:	2043231
Source Port:	49699
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 84.38.129.21 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:12:02.830260+0200
SID:	2043234
Source Port:	1912
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 13.85.23.86 - Destination IP: 192.168.2.7

Timestamp:	2024-07-26T09:12:58.931591+0200
SID:	2022930
Source Port:	443
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC Activity - Source IP: 192.168.2.7 - Destination IP: 84.38.129.21

Timestamp:	2024-07-26T09:12:11.660867+0200
SID:	2043231
Source Port:	49699
Destination Port:	1912
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Bankcopyscanneddoc.exe

Avira: detected

Found malware configuration

Source: Bankcopyscanneddoc.exe

Malware Configuration Extractor: RedLine {"C2 url": ["84.38.129.21:1912"], "Bot Id": "foz", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Multi AV Scanner detection for submitted file

Source: Bankcopyscanneddoc.exe	ReversingLabs: Detection: 65%
Source: Bankcopyscanneddoc.exe	Virustotal: Detection: 79%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Bankcopyscanneddoc.exe

Joe Sandbox ML: detected

Source: Bankcopyscanneddoc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Bankcopyscanneddoc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 4x nop then jmp 07965E23h	0_2_07965BF0
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 4x nop then jmp 07964F22h	0_2_07964B00
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 4x nop then jmp 079653A2h	0_2_07964B00
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 4x nop then jmp 07963018h	0_2_07963000

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 84.38.129.21:1912

Source: global traffic

TCP traffic: 192.168.2.7:49699 -> 84.38.129.21:1912

Source: Joe Sandbox View

ASN Name: DATACLUB-NL DATACLUB-NL

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.21

Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmX
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/D
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp, Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3ResponseD
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: Bankcopyscanneddoc.exe	String found in binary or memory: https://api.ip.sb/ip

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_0109DC74	0_2_0109DC74
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FFEE58	0_2_04FFEE58
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FF8850	0_2_04FF8850
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FF0040	0_2_04FF0040
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FF003C	0_2_04FF003C
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FF8840	0_2_04FF8840
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07962718	0_2_07962718
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07960E48	0_2_07960E48
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_079615A0	0_2_079615A0
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07966418	0_2_07966418
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07969C38	0_2_07969C38
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07964B00	0_2_07964B00
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_079632C0	0_2_079632C0
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07964270	0_2_07964270
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_079620D8	0_2_079620D8
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07963828	0_2_07963828
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07960040	0_2_07960040
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07960E37	0_2_07960E37
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_079632AF	0_2_079632AF
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07964AF6	0_2_07964AF6
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_07964260	0_2_07964260
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_079620CA	0_2_079620CA

Source: Bankcopyscanneddoc.exe, 00000000.00000002.1362445132.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000000.1250820901.0000000000756000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSteanings.exe8 vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\000004B0\\OriginalFilename vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\040904B0\\OriginalFilename vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q,\\StringFileInfo\\080904B0\\OriginalFilename vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs Bankcopyscanneddoc.exe
Source: Bankcopyscanneddoc.exe	Binary or memory string: OriginalFilenameSteanings.exe8 vs Bankcopyscanneddoc.exe

Source: Bankcopyscanneddoc.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

File created: C:\Users\user\AppData\Local\SystemCache

Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Mutant created: NULL

Source: Bankcopyscanneddoc.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Bankcopyscanneddoc.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Bankcopyscanneddoc.exe	ReversingLabs: Detection: 65%
Source: Bankcopyscanneddoc.exe	Virustotal: Detection: 79%

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32

Jump to behavior

Source: Bankcopyscanneddoc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Bankcopyscanneddoc.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Bankcopyscanneddoc.exe

Static PE information: 0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_04FFD442 push eax; ret		0_2_04FFD451
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Code function: 0_2_0796797A push esp; retf		0_2_07967981

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Memory allocated: 2B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Window / User API: threadDelayed 1263			Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Window / User API: threadDelayed 1790			Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe TID: 2716	Thread sleep time: -13835058055282155s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe TID: 6020	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1362612231.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002CE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1365694259.0000000003F26000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Users\user\Desktop\Bankcopyscanneddoc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Bankcopyscanneddoc.exe, 00000000.00000002.1362665832.0000000000EE7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Bankcopyscanneddoc.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Bankcopyscanneddoc.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250760554.0000000000712000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bankcopyscanneddoc.exe PID: 6312, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.walletLR
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\walletsLR
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: qdC:\Users\user\AppData\Roaming\Binance
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q&%localappdata%\Coinomi\Coinomi\walletsLR
Source: Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q9C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Bankcopyscanneddoc.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bankcopyscanneddoc.exe PID: 6312, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Bankcopyscanneddoc.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Bankcopyscanneddoc.exe.710000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1250760554.0000000000712000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bankcopyscanneddoc.exe PID: 6312, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Bankcopyscanneddoc.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
Bankcopyscanneddoc.exe	80%	Virustotal		Browse
Bankcopyscanneddoc.exe	100%	Avira	TR/AD.RedLineSteal.iyobn
Bankcopyscanneddoc.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23ResponseD	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/sc	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1ResponseD	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23Response	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	0%	URL Reputation	safe
http://tempuri.org/D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/06/addressingex	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/10/wscoor	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23ResponseD	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id4	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	Bankcopyscanneddoc.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1ResponseD	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id9Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id20	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id23	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id24Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id17	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id10Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3ResponseD	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002F8E000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id23Response	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/D	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/06/addressingex	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	Bankcopyscanneddoc.exe, 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
84.38.129.21	unknown	Latvia		203557	DATACLUB-NL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1482847
Start date and time:	2024-07-26 09:11:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bankcopyscanneddoc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 38 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:12:08	API Interceptor	18x Sleep call for process: Bankcopyscanneddoc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACLUB-NL	xCjIO3SCur0S.exe	Get hash	malicious	Remcos	Browse	185.29.11.23
	new.cmd	Get hash	malicious	GuLoader	Browse	185.29.11.28
	temp.cmd	Get hash	malicious	Unknown	Browse	185.29.11.28
	price_request_.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.62
	disprovable.dll	Get hash	malicious	CryptOne, Qbot	Browse	84.38.133.191
	BL.xls	Get hash	malicious	Lokibot	Browse	84.38.129.114
	kej177el6.dll	Get hash	malicious	Qbot	Browse	84.38.133.191
	e0CIQlOSBx.exe	Get hash	malicious	Remcos, DBatLoader	Browse	84.38.133.134
	6K9552cWbC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	84.38.133.134
	VMefbbeoVM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.29.11.109

Process:	C:\Users\user\Desktop\Bankcopyscanneddoc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.081282873476631
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Bankcopyscanneddoc.exe
File size:	307'712 bytes
MD5:	901969f80acf800e522c7e2e73840e22
SHA1:	de89bca939c5674b3afca2eaa34f2e578b3f9c84
SHA256:	f03d12cadb70aa5f2d93285bf541f8a02e4fe24c574d7eb5062c693cfb6fc076
SHA512:	12879e31390b6a4c074fefdaff426efb43b82e478de9d29aed1e0a1a5e6e1bfe1987789274c178b2f44be5951cac7b77845c4532783acafb753849a440b71ab5
SSDEEP:	3072:+cZqf7D34xp/0+mAQkygx9QEgJ/B1fA0PuTVAtkxzx3RQeqiOL2bBOA:+cZqf7DIjnH6lB1fA0GTV8kXwL
TLSH:	4A645B5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@................................

File Icon


Icon Hash:	4d8ea38d85a38e6d

Static PE Info

General

Entrypoint:	0x43028e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD22848DC [Tue Sep 23 12:17:32 2081 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30238	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x1c9c6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x50000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x2e294	0x2e400	72d90635ff7e01a48350fdd4c42b5460	False	0.4747730152027027	data	6.186205546769274	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x32000	0x1c9c6	0x1ca00	a8cf3f8ff27a4a736ba8fb433d91107f	False	0.2380765556768559	data	2.615031395625776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x50000	0xc	0x200	21472a05bd31cf3b960b3bcc0808216b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32220	0x3d04	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9934058898847631
RT_ICON	0x35f24	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2835 x 2835 px/m	0.09013072282030049
RT_ICON	0x4674c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2835 x 2835 px/m	0.13905290505432216
RT_ICON	0x4a974	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2835 x 2835 px/m	0.17033195020746889
RT_ICON	0x4cf1c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	0.2045028142589118
RT_ICON	0x4dfc4	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2835 x 2835 px/m	0.24645390070921985
RT_GROUP_ICON	0x4e42c	0x5a	data	0.7666666666666667
RT_VERSION	0x4e488	0x352	data	0.4447058823529412
RT_MANIFEST	0x4e7dc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T09:12:08.384450+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1912	49699	84.38.129.21	192.168.2.7
2024-07-26T09:12:08.206533+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49699	1912	192.168.2.7	84.38.129.21
2024-07-26T09:12:20.036450+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49701	13.85.23.86	192.168.2.7
2024-07-26T09:12:02.655038+0200	TCP	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49699	1912	192.168.2.7	84.38.129.21
2024-07-26T09:12:11.875496+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49699	1912	192.168.2.7	84.38.129.21
2024-07-26T09:12:02.830260+0200	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1912	49699	84.38.129.21	192.168.2.7
2024-07-26T09:12:58.931591+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49705	13.85.23.86	192.168.2.7
2024-07-26T09:12:11.660867+0200	TCP	2043231	ET MALWARE Redline Stealer TCP CnC Activity	49699	1912	192.168.2.7	84.38.129.21

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 09:12:01.652684927 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:01.657685995 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:01.657808065 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:01.666865110 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:01.671979904 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:02.284023046 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:02.327039957 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:02.655038118 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:02.660070896 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:02.830260038 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:02.873908043 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:08.206532955 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:08.211838007 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384136915 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384185076 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384196997 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384282112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384284019 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:08.384377003 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:08.384449959 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384460926 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:08.384572029 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.796834946 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803107023 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803210974 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803236008 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803265095 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803280115 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803288937 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803309917 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803318024 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803339958 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803356886 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803549051 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803637981 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803675890 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803680897 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.803689957 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.803738117 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810000896 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810024023 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810082912 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810127020 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810137033 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810153961 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810164928 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810187101 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810194016 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810205936 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810235977 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810425997 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810519934 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.810909986 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.810986996 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.816042900 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.816098928 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.816337109 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.816395998 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.816462994 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.816504002 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.816530943 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.816560030 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.817903996 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.817960978 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.818147898 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.818205118 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.818223953 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.818279982 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.818281889 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.818331003 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.818367004 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.818447113 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.821445942 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821460009 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821472883 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821485996 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821496010 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821508884 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821510077 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.821521044 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821527958 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821537971 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.821542025 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821553946 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821563959 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821574926 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821607113 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821619034 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821625948 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.821755886 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.822815895 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822825909 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822873116 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822890997 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822901011 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822915077 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.822916985 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822926998 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822941065 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822943926 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.822961092 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822967052 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.822971106 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822983980 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.822997093 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.823008060 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823015928 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823030949 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823031902 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.823038101 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823054075 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.823060989 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823076010 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.823096037 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.823102951 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.829910040 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.829988956 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.829993010 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830192089 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830200911 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830216885 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830228090 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830240965 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830248117 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830271959 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830285072 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830298901 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830324888 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830337048 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830427885 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830440044 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830457926 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830466032 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830490112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830502987 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830560923 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830569983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830648899 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830702066 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830782890 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830815077 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830836058 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830879927 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830982924 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.830991983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831008911 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831011057 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.831020117 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831101894 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.831114054 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831125975 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831351995 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831366062 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831381083 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831393003 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831410885 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831425905 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831552982 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831576109 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831744909 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831758976 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831851006 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831862926 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831959963 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.831971884 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832010031 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832021952 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832072973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832086086 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832097054 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832117081 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832130909 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832206964 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832272053 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832283974 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832350969 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832434893 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832447052 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832470894 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832530975 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832540035 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832591057 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832602024 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832667112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832679987 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832899094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832911968 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832957983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.832972050 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833017111 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833029032 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833055973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833065033 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833100080 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.833381891 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.833453894 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.836144924 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836220026 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836335897 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836344957 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836359024 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836368084 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836544991 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836555004 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836569071 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836579084 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836592913 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836611986 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836620092 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836636066 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836803913 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836812973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836828947 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836837053 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836863041 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836874008 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836886883 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836896896 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.836947918 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837217093 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837225914 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837246895 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837253094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837255001 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837259054 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837275028 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837285042 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837297916 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837320089 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837330103 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837342978 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837351084 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837366104 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837440968 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837452888 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837464094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837477922 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837488890 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837587118 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837596893 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837614059 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.837622881 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838474035 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838486910 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838499069 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838512897 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838522911 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838535070 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838550091 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838551998 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838553905 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838726997 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838736057 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838754892 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838767052 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838778973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838788986 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838792086 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.838845968 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838850975 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.838860035 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838875055 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838882923 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838907957 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838916063 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.838965893 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839030027 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839041948 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839056015 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839097977 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839109898 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839157104 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839215040 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839226961 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839632034 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839641094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839644909 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839648008 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839652061 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839654922 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839658022 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839660883 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839664936 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839874983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839888096 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839901924 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839912891 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839924097 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839939117 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839951992 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839961052 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839973927 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.839987993 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841525078 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841536999 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841551065 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841558933 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841576099 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841586113 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841598988 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841609001 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841624975 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841635942 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.841667891 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844469070 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844477892 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844568968 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844578028 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844594002 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844610929 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844624043 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844717979 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.844719887 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844734907 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844750881 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844763041 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844794035 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.844808102 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.844824076 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845254898 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845263958 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845277071 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845284939 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845298052 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845309019 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845381975 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845392942 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845400095 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845411062 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845433950 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845444918 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845453024 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845467091 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845474005 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845485926 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845496893 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845509052 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845518112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845531940 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845539093 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845554113 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845561981 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845577955 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845607996 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845608950 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845612049 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845823050 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845833063 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845848083 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845855951 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845870018 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845876932 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845889091 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845896006 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845910072 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845935106 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845946074 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.845952988 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.846194983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852437973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852458000 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852466106 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852492094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852499962 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852505922 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852525949 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852718115 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852725983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852740049 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852757931 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852767944 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852780104 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852858067 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852936029 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852947950 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852988005 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.852998972 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853044033 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853055954 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853101015 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853111982 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853172064 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853182077 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853199005 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853276014 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853286982 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853318930 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853332996 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853369951 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853389978 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.853450060 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854337931 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854389906 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854454994 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854473114 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854491949 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854537010 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854563951 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854600906 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854691029 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854705095 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854716063 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854914904 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854928017 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854938984 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854953051 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.854960918 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.855319977 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.855329037 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.855344057 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.855359077 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.855366945 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.857420921 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.857486963 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.862359047 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862369061 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862488985 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862495899 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862509012 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862518072 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862565994 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862574100 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862601995 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862610102 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862673998 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862685919 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862709045 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862720966 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862771988 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.862792015 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862804890 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862840891 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.862860918 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.862873077 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864384890 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864393950 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864411116 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864418983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864434958 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864443064 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864459991 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864470959 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864485979 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864507914 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864514112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864527941 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864535093 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864548922 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864557981 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864568949 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.864576101 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.895570040 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.895790100 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.895873070 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.895873070 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.895936012 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.900923967 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901062965 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901221991 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901253939 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901349068 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901362896 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901416063 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901427031 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901470900 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901484013 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901526928 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901537895 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901619911 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901628017 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901873112 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901886940 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901958942 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.901968002 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902048111 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902060986 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902105093 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902112961 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902198076 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902206898 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902241945 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.902251005 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.930143118 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.930313110 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:10.935456038 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935472012 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935570002 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935581923 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935607910 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935653925 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935705900 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935714006 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935774088 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935801983 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:10.935900927 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:11.660139084 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:11.660866976 CEST	49699	1912	192.168.2.7	84.38.129.21
Jul 26, 2024 09:12:11.666783094 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:11.838006973 CEST	1912	49699	84.38.129.21	192.168.2.7
Jul 26, 2024 09:12:11.875495911 CEST	49699	1912	192.168.2.7	84.38.129.21

Target ID:	0
Start time:	03:12:00
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\Bankcopyscanneddoc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Bankcopyscanneddoc.exe"
Imagebase:	0x710000
File size:	307'712 bytes
MD5 hash:	901969F80ACF800E522C7E2E73840E22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1250760554.0000000000712000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1363475474.0000000002BA6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1363475474.0000000002D83000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	150
Total number of Limit Nodes:	14

Executed Functions

Function 07964B00 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$q, xrefs: 07964EE9
$q, xrefs: 07965299
$q, xrefs: 07965366
$q, xrefs: 07964E25

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q
API String ID: 0-4102054182
Opcode ID: 7bb4b0a9562c84d97202c35bade307d84785be1e5332427dfa578e08139fd68d
Instruction ID: 5542c727d2c2f1e6b6bab0f60af7599cc2bf0fa2935b41ad78058ffcf516ec43
Opcode Fuzzy Hash: 7bb4b0a9562c84d97202c35bade307d84785be1e5332427dfa578e08139fd68d
Instruction Fuzzy Hash: E332B174E01228CFDB68DF64C995BDEBBB2BB89300F1085E9D509AB254DB359E81CF44

Function 079615A0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1, xrefs: 0796190F
., xrefs: 07961894

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID: .$1
API String ID: 0-1839485796
Opcode ID: 2c1c45bcc5cbea19754d20dafac814ae853bffe7d946d652127f081ec9e2157e
Instruction ID: 63a04690fbf7634ed040b6ba38e3808776026f3c1ca0f2d768ed22e9b1a2a11c
Opcode Fuzzy Hash: 2c1c45bcc5cbea19754d20dafac814ae853bffe7d946d652127f081ec9e2157e
Instruction Fuzzy Hash: 1BD1B274E01218CFDB68DFA5C980BDDB7B2BF89304F6085AAD409AB254DB359E85CF50

Function 04FFEE58 Relevance: 2.5, Strings: 1, Instructions: 1231COMMON

Download Yara Rule

Strings

,7q, xrefs: 04FFF497

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID: ,7q
API String ID: 0-3839523172
Opcode ID: b609d8b56a5023a35cefd46cb6f03bb28aa2b08982dbb132e524165f4453da44
Instruction ID: 35fdcf2ecc017c359ddd72e8b301df8585574d366721451b7f057e93abed921e
Opcode Fuzzy Hash: b609d8b56a5023a35cefd46cb6f03bb28aa2b08982dbb132e524165f4453da44
Instruction Fuzzy Hash: 1D92B374B503058FEB249BB8D8A576E7AF3EFC8240B644429E506DB395DE74EC02CB91

Function 07962718 Relevance: 1.8, Strings: 1, Instructions: 525
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s(, xrefs: 07962805, 0796280A

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID: s(
API String ID: 0-3583383123
Opcode ID: 1063b9cce8743f82940675a883b03523afcaef021364808ec8db3448a0755d55
Instruction ID: 20f5f0d7bcec11e41ece4235a543001da976335382bfdcba853d85425b8de426
Opcode Fuzzy Hash: 1063b9cce8743f82940675a883b03523afcaef021364808ec8db3448a0755d55
Instruction Fuzzy Hash: 6242CF74E012298FDB64DF64C994BEEBBB2BF89300F5085E9D40AAB254DB315E85CF40

Function 07965BF0 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

$q, xrefs: 07965DA4

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID: $q
API String ID: 0-1301096350
Opcode ID: 0a6d7ea74c9ef4bc6b1cff42184187817aa1b8f6537c910c6f7a6ed464f94d5e
Instruction ID: 1873358621ac22b5de8ea409183f6db20d5758ae994b62ca017c8b8610b76433
Opcode Fuzzy Hash: 0a6d7ea74c9ef4bc6b1cff42184187817aa1b8f6537c910c6f7a6ed464f94d5e
Instruction Fuzzy Hash: F771D2B4E01218DFDF28DFA5D594AADBBB2FF89304F609529D415AB354DB349841CF40

Function 07963828 Relevance: .4, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412d66ac3afc8e871da0cc7008e6da89ad30b1466addd41c60dd06eb7fd55568
Instruction ID: b279f302dba9d13e89421283a6e232f95daebf2f17f3d4dbbff49b2271e17217
Opcode Fuzzy Hash: 412d66ac3afc8e871da0cc7008e6da89ad30b1466addd41c60dd06eb7fd55568
Instruction Fuzzy Hash: 7F226B74E012288FDB64DF68C995BDDBBB2BB49300F1085EAD549AB350DB319E85CF50

Function 07966418 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3083a0e55caaafa4ef8ec3e6a5374127fcd0aa015247af24aed481ef62394f5b
Instruction ID: 4335a746d5f19262a7f99ffb7e88f2b133ca13370463bc1a00f8c4408ec587d8
Opcode Fuzzy Hash: 3083a0e55caaafa4ef8ec3e6a5374127fcd0aa015247af24aed481ef62394f5b
Instruction Fuzzy Hash: FF02C074A01229CFDB68DF64C994B9DBBB2BF89300F1085E9D409AB354DB31AE81CF54

Function 07969C38 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54216c201c6756cf74d1294c0f696d8133fb974ab36cc06b8a9ec348c001a9d5
Instruction ID: dac017d93032994626716afca5118253f6a45910f224173fb07e79ba54aaf8f5
Opcode Fuzzy Hash: 54216c201c6756cf74d1294c0f696d8133fb974ab36cc06b8a9ec348c001a9d5
Instruction Fuzzy Hash: F5C19CB17006018FDB25EB76C4687AE77EAAFC9714F10456DE186DB290DF35E801CB62

Function 079620D8 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f77c7098240e787cb7a6185635681e925afa506adea663e61def7a01e635e8
Instruction ID: 6bbb0f7b8b9b7478252cc0002c3fa09656bd9e5b1fc04264f13157b0fbf344d3
Opcode Fuzzy Hash: d0f77c7098240e787cb7a6185635681e925afa506adea663e61def7a01e635e8
Instruction Fuzzy Hash: 52F1B074A01228CFDB28DF64C991B9EBBB2BF89304F5085E9D509AB354DB319E81CF50

Function 07960E48 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718aea3ffc78046e0629a3dd6918ad2399e25daa5e6f12ea25f954ea11492ddf
Instruction ID: c385569a4ab7609ee626f15ad667e54c0c5caf1a9d2436c55129bad5ce0eea41
Opcode Fuzzy Hash: 718aea3ffc78046e0629a3dd6918ad2399e25daa5e6f12ea25f954ea11492ddf
Instruction Fuzzy Hash: 5FE1D374E00229CFDB68DF65C994BEDBBB2BF89300F5085AAD40AA7254DB305E85CF50

Function 04FF8840 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb7828d112c3e979ccff01a515388c87783a85729923cf04e2f9b1a000bb40e
Instruction ID: d77023c12359731e665152ad2474a67aa8698644327f133de61b8b92c558df25
Opcode Fuzzy Hash: acb7828d112c3e979ccff01a515388c87783a85729923cf04e2f9b1a000bb40e
Instruction Fuzzy Hash: 3FD1E674A10318CFCB14EFB4D99469DBBB2FF8A301F1085A9E40AAB254DF359986CF51

Function 04FF8850 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe3d928a140080df4cbe8f9915ee3ab2fb8c49193995a7f7d45a1369ebb18f8
Instruction ID: bcee20c3bbc4a5ef1ada0df720d1701c1435518139e7081fb765e931b8bbb637
Opcode Fuzzy Hash: bbe3d928a140080df4cbe8f9915ee3ab2fb8c49193995a7f7d45a1369ebb18f8
Instruction Fuzzy Hash: 1CD1E674A10318CFCB14EFB4D99469DBBB2FF8A301F1085A9E40AAB254DF359986CF51

Function 079632C0 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63d5b69c6b002b76b75180dd347e434aced5b7261152b7db291e9fdc6d30ada9
Instruction ID: 2f54a39a5078e7bc377e2e702fcf600b62f1660b58be4aefeede288c31fcb87f
Opcode Fuzzy Hash: 63d5b69c6b002b76b75180dd347e434aced5b7261152b7db291e9fdc6d30ada9
Instruction Fuzzy Hash: D5D1B1B4E01218CFDB64DFA5C898B9DBBB2BF89304F1085A9D409AB354DB359D85CF10

Function 07960040 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058bcd60c7f253eacef765d7de8bf161cbb1f3af7b8a3c11bdbc1a8e4051eec9
Instruction ID: f0fa45901addf992edff79a77674028d6fd9be0f529876eec6be0d757237debe
Opcode Fuzzy Hash: 058bcd60c7f253eacef765d7de8bf161cbb1f3af7b8a3c11bdbc1a8e4051eec9
Instruction Fuzzy Hash: 1CC1D2B0D01219CFEB24DFA5C994BEDBBB6BF89304F1085AAD409AB250DB345E85CF51

Function 07964270 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0737b50f975eb48062f4a0bf4ea7e7144d5f9371ca1a11afcb22782aebafc272
Instruction ID: 74544b0853d017c886ebb653b4f788ea20e957266f7ff105b603c89379435215
Opcode Fuzzy Hash: 0737b50f975eb48062f4a0bf4ea7e7144d5f9371ca1a11afcb22782aebafc272
Instruction Fuzzy Hash: FFB1C774E01228CFDB68DF65C994B9DBBB2BF89300F1085AAD409AB355DB309E85CF50

Function 079620CA Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6ff0922250eaedbe5a3d37a9d8c39c4b438752e5d016806c2569ff05ea122c
Instruction ID: 56f80ebe8c9b4bdac7821a336795156bc05b5d3d6ac8d5610f4b50e055d51bcb
Opcode Fuzzy Hash: 9a6ff0922250eaedbe5a3d37a9d8c39c4b438752e5d016806c2569ff05ea122c
Instruction Fuzzy Hash: 20A1C574E01228CFEB28DFA5D950B9EBBB2BF88300F5085AAD5096B354DB315E85CF51

Function 07964260 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbb01b32d2c39dd3509a6c505a0b40ea71339072ed77d4eda23f993857a8ef27
Instruction ID: 67e36d4a8283d4f99b50c532fddd878347fa482d902bf7e847e5d11ba4f3a4b5
Opcode Fuzzy Hash: cbb01b32d2c39dd3509a6c505a0b40ea71339072ed77d4eda23f993857a8ef27
Instruction Fuzzy Hash: 983118B1D016189BEB28CFA6C8447DEFBB7AF89304F10C56AC808AB255DB714A85CF50

Function 0109AE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0109B086

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e9e532a6dc430d11009784ee1cb76a0147ea13f27f27d919c071cdc394fbdce9
Instruction ID: afe5a9b390a1585e4620d3fc4257066f30269ba3533381b3f792414d272051f8
Opcode Fuzzy Hash: e9e532a6dc430d11009784ee1cb76a0147ea13f27f27d919c071cdc394fbdce9
Instruction Fuzzy Hash: 9B7138B0A00B05CFEB64DF69D16479ABBF1FF88204F00892DD49ADBA50D775E846CB91

Function 04FF1CE4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04FF1E02

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9060df34c965043ef8660ed6478c4872ed682e278f896b70844a35d5f867d73d
Instruction ID: 08297205bdcaffd13293dd8a5006b902eb4f239b0fd55624e5b125fe4269c792
Opcode Fuzzy Hash: 9060df34c965043ef8660ed6478c4872ed682e278f896b70844a35d5f867d73d
Instruction Fuzzy Hash: 9851D0B1D00319DFDB14CFA9C984ADEBBB5BF48310F24822AE818AB210D771A845CF94

Function 04FF0AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04FF1E02

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 38ded6587617d390c22daf92d7f509eb08269a82f2e92d81d7a6486c46a0295f
Instruction ID: 7c4a0a244527a5f2166af6fee2c7d93580440c2a9fb8d068330f5510b4542a23
Opcode Fuzzy Hash: 38ded6587617d390c22daf92d7f509eb08269a82f2e92d81d7a6486c46a0295f
Instruction Fuzzy Hash: AD51C0B1D00319DFDB14CF9AC984ADEBBF5BF48310F24812AE919AB210D775A845CF94

Function 01095935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010959F1

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fdafc7286f99d7286bf3df9cf69a25f137388068104a26e6437d1eb27934406e
Instruction ID: 186931406d48fdaabd9341f01a327ff6b9531bcc809e2d893732cddcbc5516c6
Opcode Fuzzy Hash: fdafc7286f99d7286bf3df9cf69a25f137388068104a26e6437d1eb27934406e
Instruction Fuzzy Hash: 6B41EEB0D00729CFEB24CFAAC88478DBBF5BF48304F20816AD418AB251DB756946CF94

Function 04FF0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04FF4381

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: cc127073fb0a524c13477555f4b684ffe8fc473ed8c8efc4f007b2cd103665fd
Instruction ID: 0f6f2d3dc36289f6e308f3519b23840b642f0e8a4edcfd5b4fdc1a01ec815153
Opcode Fuzzy Hash: cc127073fb0a524c13477555f4b684ffe8fc473ed8c8efc4f007b2cd103665fd
Instruction Fuzzy Hash: F2413BB5A00309DFDB14CF95C848AABBBF5FF88314F248559D519AB321D375A841CFA1

Function 01094248 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 010959F1

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 3cc08aa50cc824fc031735f09b77164bbf97dde0040a17e8ae96c4b0964a3585
Instruction ID: aec7edb6599c7079daf8f310d169007d37a8acbd7f1639c0437cd2260c37b643
Opcode Fuzzy Hash: 3cc08aa50cc824fc031735f09b77164bbf97dde0040a17e8ae96c4b0964a3585
Instruction Fuzzy Hash: EE41C170D00718CFEB25CFAAC884B9DBBF5BF49304F20816AD409AB255DB756946CF94

Function 0109C9A0 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0109D2C6,?,?,?,?,?), ref: 0109D387

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba287f94b466be0a4dd1637af2bd9d27e181305db6990741b86db64198717df6
Instruction ID: caaff716893907ea7a25ae8c1af4b6ac81fad26992d7dca348ae13f12e3b5785
Opcode Fuzzy Hash: ba287f94b466be0a4dd1637af2bd9d27e181305db6990741b86db64198717df6
Instruction Fuzzy Hash: 2521E3B5D00218EFDB10CFAAD984ADEBBF4EB48310F14801AE958A7350D375A954DFA5

Function 0109D2F9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0109D2C6,?,?,?,?,?), ref: 0109D387

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 72040fc2e28960d3f884d77c862bcf4c91839b7be431ff6fd58ddfff579d1271
Instruction ID: f949bafddd4d236539a7e47b3733fc03b5f349296f4a68d1c096aa49cfb13d38
Opcode Fuzzy Hash: 72040fc2e28960d3f884d77c862bcf4c91839b7be431ff6fd58ddfff579d1271
Instruction Fuzzy Hash: C22100B5D002189FDB10CFAAD884ADEBBF4FB48310F10801AE968A3310C378A944CFA4

Function 0109B2A0 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0109B101,00000800,00000000,00000000), ref: 0109B312

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e4ab72997f071c71d88b94b8e32c2aea903fa04ed9c3182a7a4caeb9ee742e43
Instruction ID: f380f807dab47f11d7d59a4b06638bb18fa7aa2aea1aa4b9824f8e416e69a190
Opcode Fuzzy Hash: e4ab72997f071c71d88b94b8e32c2aea903fa04ed9c3182a7a4caeb9ee742e43
Instruction Fuzzy Hash: 621129B6D003498FDB14CFAAD844ADEFBF4EB48320F10851ED969A7200C3759545CFA5

Function 0109A870 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0109B101,00000800,00000000,00000000), ref: 0109B312

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d564473414f84ab9b14e67885287f3a0a197b1a1b1a971a1015fc53af489de7c
Instruction ID: 244479d652f833419f264e1e1e5b3ab2b184472f7d17524d96d271e19db66ef8
Opcode Fuzzy Hash: d564473414f84ab9b14e67885287f3a0a197b1a1b1a971a1015fc53af489de7c
Instruction Fuzzy Hash: 071103B6D003499FDB20CF9AD444A9EFBF4EB48320F10856EE969A7200C375A545CFA5

Function 0109B020 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0109B086

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f3153627663d07800235f87f166e9a3ed41833920aff162eed740260ed1f47af
Instruction ID: 4fbcff4db7a5a881766f02f57d6107260bbfddd07dedab9076daafb9479e2f86
Opcode Fuzzy Hash: f3153627663d07800235f87f166e9a3ed41833920aff162eed740260ed1f47af
Instruction Fuzzy Hash: BF1110B6C003498FDB20CF9AD444BDEFBF4AB88224F10855AD468B7210C37AA545CFA5

Function 07967D10 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07968D9D

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8238ba16bca343a547f4658f5092d690ff55c716fc816960ad5b7cd2c5cc5fa7
Instruction ID: c2e9db9a760a5de166e1bf9a62841213390f46659e6f24e04b00ba3896dd42a0
Opcode Fuzzy Hash: 8238ba16bca343a547f4658f5092d690ff55c716fc816960ad5b7cd2c5cc5fa7
Instruction Fuzzy Hash: 271136B58003499FDB20CF9AC488BDEBBF8FB48314F10841AE514A7300C375A944CFA5

Function 07968D38 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07968D9D

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 021f78efb4bbd4da1b4dd89dff483757ec94af508966cf8a936e8ce7b111c766
Instruction ID: 3143d8c927f3086b5111cfb7a5652c642a1a6a2cbfc945abfc86cc8599aa3705
Opcode Fuzzy Hash: 021f78efb4bbd4da1b4dd89dff483757ec94af508966cf8a936e8ce7b111c766
Instruction Fuzzy Hash: B21136B59003599FDB20CF99D888BDEFFF8EB48320F20850AE558A7240C3756544CFA5

Function 0103D654 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7255670b4f48d18ab44742b020d38700e3c9941dacd3847a2d3794d369c9b653
Instruction ID: f27b41cc3c1fa3d4ec653f0479c510020e9e0b47da5ac2ed79e1d40f055cde73
Opcode Fuzzy Hash: 7255670b4f48d18ab44742b020d38700e3c9941dacd3847a2d3794d369c9b653
Instruction Fuzzy Hash: 67214B75500240EFDF16DF54D9C0B1ABBA9FBC8314F60C698E9890F246C336D412DBA1

Function 0103D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9db6590da1e1abcb15d17509447cf015e177e30916f950496d730aef3797cac
Instruction ID: 2bd960c6952d9b5168ed0eb6882ef90053a0cc32d05c7aa58494f113ce059b78
Opcode Fuzzy Hash: b9db6590da1e1abcb15d17509447cf015e177e30916f950496d730aef3797cac
Instruction Fuzzy Hash: B5213371504200EFDB15DF94D9C0B5ABBA9FBC8324F20C5A9E94A0F256C736E456CBA2

Function 0104D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362824059.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0798213ec94f90315c998950d85346c18554ac944a0056955279fc8c004374
Instruction ID: b8b8d244b6c3875dacca803492b6e60ec9ec56f56b3c11cc930f71ab60a8460d
Opcode Fuzzy Hash: 7e0798213ec94f90315c998950d85346c18554ac944a0056955279fc8c004374
Instruction Fuzzy Hash: 9621D3B1504300DFDB25DFA4D5C4B16BBA5EB94314F20C5BDE98A4B256C336D447CB61

Function 0104D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362824059.000000000104D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0104D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_104d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3c7ca55bad1af360a1645e9d40683a39278ba62920e7697660a4e6efe681f0c
Instruction ID: cb00c75aa5a964822f23ae6132ea8f4e26d3f5268b46236477bdcd2f13379d9e
Opcode Fuzzy Hash: a3c7ca55bad1af360a1645e9d40683a39278ba62920e7697660a4e6efe681f0c
Instruction Fuzzy Hash: 4D2183B55083809FCB12CF54D9D4711BFB1EB46214F24C5EAD8898F2A7C33A9806CB62

Function 0103D64F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768dc57047f853eeb21c306de65d75245ca6a2e1656418214d17e77524cda1ad
Instruction ID: ce383b61ffaa722f29e8b0075b46e980b47a2ce4b16cfea36848689c66ac009b
Opcode Fuzzy Hash: 768dc57047f853eeb21c306de65d75245ca6a2e1656418214d17e77524cda1ad
Instruction Fuzzy Hash: C1219D76504280DFCB16CF54D9C4B16BFB2FB88314F2486A9E9890B657C33AD426CB91

Function 0103D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: 181d4f1d59768408b420df079b253b150e79bedc59cabbc794fabdee18be4be2
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: 3711E172404240CFCB12CF54D5C4B56BFB1FB84324F24C6A9D9490B657C33AE456CBA1

Function 0103D9B1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56769b82d15a4210c20221b988741a4e00662a1279e76f4e464f6e7ac9cd268f
Instruction ID: a84c1402df331a93a8643f9537811b71dcf8b3fa0c2ee564731408473851c864
Opcode Fuzzy Hash: 56769b82d15a4210c20221b988741a4e00662a1279e76f4e464f6e7ac9cd268f
Instruction Fuzzy Hash: 2C01F7715087409BE7208E96CD84766BBDCDF80220F48855AED884F282C2359845CBB2

Function 0103D9B0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1362787770.000000000103D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0103D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_103d000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f2137e4af4505ced4c8a1626569bb7c5e7e25ce54dbbd62627a69db5a30d77e
Instruction ID: dcf1657a7b3b422000f483d848a9d228587f05485a880c40861f478577698a3a
Opcode Fuzzy Hash: 3f2137e4af4505ced4c8a1626569bb7c5e7e25ce54dbbd62627a69db5a30d77e
Instruction Fuzzy Hash: 82F062715087549EE7208E5ADA84B62FFDCEB81724F18C59AED485F283C3799844CB71

Non-executed Functions

Function 04FF0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a8b39eab793a796b86f743d18df8a30ef093e035902b9c2b464eea1c90c359
Instruction ID: 83c1e826a6f9e134521a7e50f0b19f0b25a82630c188619d47061669997581f4
Opcode Fuzzy Hash: 89a8b39eab793a796b86f743d18df8a30ef093e035902b9c2b464eea1c90c359
Instruction Fuzzy Hash: 8612B9F2E997658BD310CF25F84C2A93BB1BB41318FD24A09D2611F2E6DBB4156ACF44

Function 0109DC74 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1363035199.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6401c7fdaac9ab23ceef0c5e83a0f0a4f0bba8939fb911b692a81e8a4380b284
Instruction ID: 6f0243997ce99d58868614b6a081ed06290cfe2fe7a72e916039d5a9bc58318f
Opcode Fuzzy Hash: 6401c7fdaac9ab23ceef0c5e83a0f0a4f0bba8939fb911b692a81e8a4380b284
Instruction Fuzzy Hash: A8A19132E0061A8FCF05DFB8C8505DEBBF2FF84300B1585AAE945AB265DB71D955DB80

Function 04FF003C Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1368743870.0000000004FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ff0000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5727a565f0078e12d5334d4c62d3ac38e2d73973fe3c67e142ea27ae54e1ee61
Instruction ID: d60525b812f937883fb0bfc6e1bfe37bf4aa41cb64a3938081e926d8292ce7a4
Opcode Fuzzy Hash: 5727a565f0078e12d5334d4c62d3ac38e2d73973fe3c67e142ea27ae54e1ee61
Instruction Fuzzy Hash: BDC12BB2E987658BD710CF25F8481A97BB1BF81324FD24A09D1612F2E6DBB42466CF44

Function 07964AF6 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a68e7a1db6690f05a20a33a2601072530388c57e166780f9d43fff08a3126d
Instruction ID: 757b02b9a6e725411c209656e0122e4ba8a40a797ae6898b057901254ab16ac6
Opcode Fuzzy Hash: e2a68e7a1db6690f05a20a33a2601072530388c57e166780f9d43fff08a3126d
Instruction Fuzzy Hash: D151D474E002188FDB28DF65C941BDEBBB2BF88304F14D1E9D549AB264DB349A81CF55

Function 079632AF Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee83a3b30930586bb06992a31136f76f026d3953440bb0c44a6ddd981fd1546
Instruction ID: b80b76c3c7b150ccaf5758e734a0267f75e81663df9d8eecee2bdef91492271d
Opcode Fuzzy Hash: cee83a3b30930586bb06992a31136f76f026d3953440bb0c44a6ddd981fd1546
Instruction Fuzzy Hash: EB310AB5D003088FEB28CFA6D9496DEFBF6AF89300F14D12AD419AB254DB711846CF54

Function 07960E37 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e386cb18a7d4a81ad3d5069b0fbba5e24ddc59bdc8e5f31df7e9ae6eb13c0fe2
Instruction ID: f0e207ab648db1139be5956a73f552f0db1a2b23bdc4b9846c59a91933492336
Opcode Fuzzy Hash: e386cb18a7d4a81ad3d5069b0fbba5e24ddc59bdc8e5f31df7e9ae6eb13c0fe2
Instruction Fuzzy Hash: 1F312BB5D0021C8BEB28CF7AD949BDEBBF6AF85314F14C26AD409A7255DB700985CF50

Function 07963000 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1374757099.0000000007960000.00000040.00000800.00020000.00000000.sdmp, Offset: 07960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7960000_Bankcopyscanneddoc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c2f5c469ae64c25b395a59b23f97e2764c68814edfc797d476da30f50c46af
Instruction ID: 211055d06c92877f585fb68788c0cd86ca049310c9438d840aafae6b6e06f91b
Opcode Fuzzy Hash: 74c2f5c469ae64c25b395a59b23f97e2764c68814edfc797d476da30f50c46af
Instruction Fuzzy Hash: 0AE092B0C5560EDAD7149FA1C0097FEFA747B46318FA06909840673281CAB08A488F65

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bankcopyscanneddoc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Bankcopyscanneddoc.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
Bankcopyscanneddoc.exe

Function 07964B00 Relevance: 5.5, Strings: 4, Instructions: 496
COMMON

Function 079615A0 Relevance: 2.8, Strings: 2, Instructions: 304
COMMON

Function 07962718 Relevance: 1.8, Strings: 1, Instructions: 525
COMMON

Function 0109AE30 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 04FF1CE4 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Function 04FF0AA8 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 01095935 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 04FF0BFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON