Windows Analysis Report
UD61dgs2rz.exe

Machine Learning detection for dropped file

Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2197786692.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: UD61dgs2rz.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004315EC CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

14_2_004315EC

Source: UD61dgs2rz.exe, 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_40d683fb-8

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 4x nop then jmp 07038C75h		0_2_07038F9C
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 4x nop then jmp 07287F0Dh		10_2_07288234

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 204.10.160.230

Source: global traffic

TCP traffic: 192.168.2.5:49725 -> 204.10.160.230:7983

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50
Source: Joe Sandbox View	IP Address: 204.10.160.230 204.10.160.230

Source: Joe Sandbox View

ASN Name: UNREAL-SERVERSUS UNREAL-SERVERSUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0041936B InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

14_2_0041936B

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: geoplugin.net
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: UD61dgs2rz.exe, HODoCxSdp.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: UD61dgs2rz.exe, HODoCxSdp.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/-6
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/N
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp, UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, HODoCxSdp.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: UD61dgs2rz.exe, 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp6
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp:
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp?
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: UD61dgs2rz.exe, HODoCxSdp.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: UD61dgs2rz.exe, 00000000.00000002.2170083571.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000A.00000002.2223615700.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UD61dgs2rz.exe, HODoCxSdp.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00409340 SetWindowsHookExA 0000000D,0040932C,00000000

14_2_00409340

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00414EC1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

14_2_00414EC1

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0040A65A OpenClipboard,GetClipboardData,CloseClipboard,

14_2_0040A65A

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00409468 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,

14_2_00409468

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2197786692.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0041A76C SystemParametersInfoW,

14_2_0041A76C

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00414DB4 ExitWindowsEx,LoadLibraryA,GetProcAddress,

14_2_00414DB4

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050C4310	0_2_050C4310
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050C3448	0_2_050C3448
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050CAF50	0_2_050CAF50
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050CAF60	0_2_050CAF60
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050C3FD9	0_2_050C3FD9
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07038AB1	0_2_07038AB1
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07030040	0_2_07030040
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_070347C8	0_2_070347C8
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07038AB1	0_2_07038AB1
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07033528	0_2_07033528
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07032CB8	0_2_07032CB8
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07035168	0_2_07035168
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07035178	0_2_07035178
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_0703B990	0_2_0703B990
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_07030013	0_2_07030013
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_070330F0	0_2_070330F0
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07280040	10_2_07280040
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07287D49	10_2_07287D49
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_072847C8	10_2_072847C8
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07283528	10_2_07283528
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07285168	10_2_07285168
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07285178	10_2_07285178
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07280007	10_2_07280007
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_072830F0	10_2_072830F0
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_0728AC28	10_2_0728AC28
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07282CB8	10_2_07282CB8
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_07287D49	10_2_07287D49
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00425152	14_2_00425152
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00435286	14_2_00435286
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004513D4	14_2_004513D4
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0045050B	14_2_0045050B
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00436510	14_2_00436510
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004316FB	14_2_004316FB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0043569E	14_2_0043569E
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00443700	14_2_00443700
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004257FB	14_2_004257FB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004128E3	14_2_004128E3
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00425964	14_2_00425964
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0041B917	14_2_0041B917
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0043D9CC	14_2_0043D9CC
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00435AD3	14_2_00435AD3
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00424BC3	14_2_00424BC3
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0043DBFB	14_2_0043DBFB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0044ABA9	14_2_0044ABA9
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00433C0B	14_2_00433C0B
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00434D8A	14_2_00434D8A
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0043DE2A	14_2_0043DE2A
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0041CEAF	14_2_0041CEAF
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00435F08	14_2_00435F08

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\HODoCxSdp.exe D1B50FC6CE79320A88DEFEF33BAF6A51E30845BD13AB2B52F7925BA0B8F527CD

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: String function: 00402073 appears 51 times
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: String function: 00432B90 appears 53 times
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: String function: 00432525 appears 41 times

Source: UD61dgs2rz.exe, 00000000.00000000.2123831467.00000000000FA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZpnl.exe2 vs UD61dgs2rz.exe
Source: UD61dgs2rz.exe, 00000000.00000002.2180273618.0000000006E40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs UD61dgs2rz.exe
Source: UD61dgs2rz.exe, 00000000.00000002.2170083571.00000000024E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs UD61dgs2rz.exe
Source: UD61dgs2rz.exe, 00000000.00000002.2168084902.000000000070E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UD61dgs2rz.exe
Source: UD61dgs2rz.exe, 00000000.00000002.2180090667.0000000006DD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMML.dll2 vs UD61dgs2rz.exe
Source: UD61dgs2rz.exe	Binary or memory string: OriginalFilenameZpnl.exe2 vs UD61dgs2rz.exe

Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: HODoCxSdp.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.SetAccessControl
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, D9EudLlbHv2APZOL2i.cs	Security API names: _0020.AddAccessRule
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@19/16@2/2

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00415C90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

14_2_00415C90

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0040E2E7 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

14_2_0040E2E7

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00419493 FindResourceA,LoadResource,LockResource,SizeofResource,

14_2_00419493

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Mutant created: \Sessions\1\BaseNamedObjects\aHbsRqcXCAHRAEQcDvjfkNSbY
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-O7QOC3
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File created: C:\Users\user\AppData\Local\Temp\tmpC22F.tmp

Source: UD61dgs2rz.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: UD61dgs2rz.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File read: C:\Users\user\Desktop\UD61dgs2rz.exe

Source: unknown	Process created: C:\Users\user\Desktop\UD61dgs2rz.exe "C:\Users\user\Desktop\UD61dgs2rz.exe"
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpC22F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Users\user\Desktop\UD61dgs2rz.exe "C:\Users\user\Desktop\UD61dgs2rz.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe C:\Users\user\AppData\Roaming\HODoCxSdp.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpD46F.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpC22F.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Users\user\Desktop\UD61dgs2rz.exe "C:\Users\user\Desktop\UD61dgs2rz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpD46F.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Data Obfuscation

Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, D9EudLlbHv2APZOL2i.cs	.Net Code: FgBnpdUPj1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, D9EudLlbHv2APZOL2i.cs	.Net Code: FgBnpdUPj1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, D9EudLlbHv2APZOL2i.cs	.Net Code: FgBnpdUPj1 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UD61dgs2rz.exe.250d414.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UD61dgs2rz.exe.250d414.0.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 0.2.UD61dgs2rz.exe.6dd0000.6.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 0.2.UD61dgs2rz.exe.6dd0000.6.raw.unpack, PingPong.cs	.Net Code: Justy
Source: 10.2.HODoCxSdp.exe.2b0d43c.0.raw.unpack, -.cs	.Net Code: _0001 System.Reflection.Assembly.Load(byte[])
Source: 10.2.HODoCxSdp.exe.2b0d43c.0.raw.unpack, PingPong.cs	.Net Code: Justy

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0041A8DA LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

14_2_0041A8DA

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050C2C30 push esp; retf	0_2_050C2C39
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_050CA9D8 push esp; iretd	0_2_050CA9D9
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Code function: 0_2_070304EA push edx; ret	0_2_070304EB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 10_2_072804EA push edx; ret	10_2_072804EB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004000D8 push es; iretd	14_2_004000D9
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040008C push es; iretd	14_2_0040008D
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004542E6 push ecx; ret	14_2_004542F9
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0045B4FD push esi; ret	14_2_0045B506
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00432BD6 push ecx; ret	14_2_00432BE9
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00454C08 push eax; ret	14_2_00454C26

Source: HODoCxSdp.exe.0.dr

Static PE information: section name: .text entropy: 7.9098783782347315

Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, zLRx0Krvxpl94Gmelc.cs	High entropy of concatenated method names: 'EQB4L53l8P', 'gnK4ZijvRb', 'foC4gMcnln', 'URD4ilVIrQ', 'MHI4mNNXXH', 'RXg4w8t06r', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, JV8COMjuieAqErQMuGa.cs	High entropy of concatenated method names: 'jPpRUlBDat', 'RCjR0ikxwX', 'hV5RpFi5pq', 'uIPNh1ovZZDc03eJ9OK', 'McMdE6oHLhe1bMWnNWV', 'oSuCUIok5xYAhNTgSrd'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	High entropy of concatenated method names: 'MZR5mbDnbO', 'sYs59UpbPG', 'ELE5Xl8Wmn', 'Gf25ISiCqV', 'kgg5rFZ9Zn', 'uXw5MmuTXG', 'ALS5C8Z78G', 'PeY5fAgDIq', 'sB25tZqQGv', 'yk55B2GSHp'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, D9EudLlbHv2APZOL2i.cs	High entropy of concatenated method names: 'CNbQJAcVb5', 's7uQPiP1Cs', 'qCwQ5Sp0qi', 'BVUQHwjPCD', 'ekFQjGeXhY', 'v30QVXIgIu', 'ud1Q2dwpK7', 'wnqQhrb0hj', 'BxDQOIYIJh', 'VtdQEP7W9w'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, j18cpQf7mkuHRbXFpl.cs	High entropy of concatenated method names: 'o272UcYVjI', 'IkQ20KqGI7', 'Bee2pXQMjH', 'eQj2DQTdAe', 'Vs82lUAkMh', 'eri2df75Ei', 'enW2xG6Nqv', 'S8j2NLVOuN', 'eTe2usWXRI', 'AN92Y3wW2o'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, A70MiS059eBQ79exbu.cs	High entropy of concatenated method names: 'xiNqN60YdT', 'LsBqutc1Jf', 'ih3qLluX1e', 'wygqZDmxIU', 'DZoqiQTcjH', 'IlpqwxYBX6', 'vFfqcvBwNL', 'Fbsq6YhC0F', 'l2oqom147T', 'r0qqAKAP8x'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, Fb16UU9rwEUap37uVW.cs	High entropy of concatenated method names: 'FO04PKlfRI', 'jtU45fpDLC', 'DBu4HERWIw', 'Ltb4jyWZr8', 'Bqo4VHukoc', 'KB942SWca1', 'X5n4hIjV45', 'SiG4OqU4E6', 'egg4E3Aepp', 'ScE4KkkTcJ'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, dYK3NXtpx6kd8ZccpM.cs	High entropy of concatenated method names: 'AHX2PbPYFU', 'KeI2H6kBnq', 'sFL2VyVWur', 'SKfVBCmeuB', 'HVUVz1l4Mo', 'HLO27IrPX5', 'CW328M4t48', 'kww2kq2nm0', 'Uxm2Q4Jw3K', 'oxT2n6vIIk'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, BoJSG7UDrVhUJiyNwB.cs	High entropy of concatenated method names: 'DpRTfK5287', 'y0XTB4lLio', 'jrN47Xag86', 'xqb48vHkqF', 'j1uTAE4QRk', 'kQDTaRHeAr', 'aECTF8Weda', 'TjKTmx7eui', 'qSuT9B5KRF', 'GFZTXiXn6X'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, eghuitF4yljFm0lKkM.cs	High entropy of concatenated method names: 'zZh82TnHuT', 'b8e8hMmqKB', 'FUu8EXaogP', 'KLJ8KekqrH', 'aFL8W4Tdeg', 'jLO8y34GqS', 'jwPwoL7htqxuauRScp', 'zYAZtv4O4FkTpx5eq8', 'kog881ZcJ9', 'Va58QI35Ca'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, RrYOk9jcPYBpJRwhDsY.cs	High entropy of concatenated method names: 'eAtSUwHgN2', 'LwrS0ieXrT', 'oZdSpgB5k3', 'pssSDPaBpW', 'VdMSlgpCkY', 'QoeSd330D1', 'tAgSxaElHl', 'CXiSNCPynd', 'omhSu8iVjP', 'qItSYsSmXe'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, qIHWAkuExOeaUujlqY.cs	High entropy of concatenated method names: 'WSgpEZ4MG', 'X6UDM5hF3', 'BfEdO9uBN', 'LRqxPSlJ5', 'vsku4ysYV', 'ghdYeYsQy', 'yl6Xhbv0h2JfbU7SqD', 'mZx6j6HlhTU3SgfsrJ', 'v9L4nd4Dp', 'eVJRli8Gy'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, JailI0yyD3oy9EWXGR.cs	High entropy of concatenated method names: 'nTaVJ9JO6e', 'SWjV5n3nAB', 'zXpVjSMBLu', 'RKbV2HJW6u', 'svEVhUYkvp', 'Yt8jr9vG3w', 'lwFjMpPhK0', 'qVQjCOCcbM', 'mMZjfc8u4e', 'Eehjtkoi7n'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, RbFpxOjX2gByO9bfJbc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9DRmYdvGC', 'O0XR93NS9h', 'm6wRXmrjtq', 'I2pRIsfTlx', 'O9ORrH7n5H', 'tCjRM8qwpH', 'b9URC6kjV5'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, mo2uG0YjKHD1aiAviU.cs	High entropy of concatenated method names: 'UvHTEHYYRJ', 'xR8TKpmMlK', 'ToString', 'A4ZTPOih7A', 'QkET5GVwmu', 'gu0THvvNke', 'YFXTjDiylY', 'gb4TVh1Q16', 'aFOT2UhtuD', 'vVmThxoyny'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, j6B1wyQDUGbllhbbhO.cs	High entropy of concatenated method names: 'VALS8kp83n', 'hvISQYk9SH', 'FsXSnrS7WN', 'VS4SPoOcB5', 'iMXS5uwhRi', 'Nm3SjJEEYI', 'L3mSVG9KxB', 'qEE4CCL2ZQ', 'E2a4fOuEEW', 'qCP4tSb5AP'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, CMxTafJa09SU85L67A.cs	High entropy of concatenated method names: 'esvjlLBaiq', 'jXGjx8b1RM', 'n7THglFIai', 'fgMHilYg5D', 'vOrHw7VjY1', 'qGvH1dRGHH', 'C2gHcxbfRd', 'lCTH6hxnQl', 'LouHbHacFB', 'H7jHoLOMJx'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, fYR6BysfY0DiREaAo2.cs	High entropy of concatenated method names: 'bgdHDJcNPO', 'J9yHdcj4VN', 'TxZHN31kqQ', 'pSiHuGeLiT', 'juRHWDlrnJ', 'HKYHyXayuI', 'xryHT3oB1K', 'in0H4pscok', 'Pf4HSvybJh', 'h2xHROBbm0'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, dMl8TwIyBpNEgmJauT.cs	High entropy of concatenated method names: 'MAjWoYxX44', 'JD4Wa9YnPK', 'paaWmQOT91', 'ecIW9tEfWO', 'DGjWZHl3We', 'fGmWgna66x', 'mx4WiedG3y', 'dfPWwhj2mN', 'U3KW1AwCCZ', 'QdFWcLbt4N'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, rOQN4VeudJysxd8645.cs	High entropy of concatenated method names: 'Dispose', 'n7n8tvTYUg', 'tEQkZNpeyR', 'FlJGGYUBaQ', 'xqv8BeqsIM', 'Xrd8zIRogm', 'ProcessDialogKey', 'wmOk7vSu2J', 'K0rk85TTNo', 'Rflkk4Vh95'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, c2cMNMpYDGGCdGPNCV.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fMnktTLXLy', 'f53kB1Hs3W', 'doAkzhdZEP', 'mUqQ75Unh6', 'tWcQ8Tq8ZZ', 'B3XQkgGALn', 'Sh9QQDBC6G', 'u1BxKpDoTTSW2HrvqNF'
Source: 0.2.UD61dgs2rz.exe.6e40000.8.raw.unpack, BET2H7355jyJGS9kPV.cs	High entropy of concatenated method names: 'WQXVXXtMaL', 'uZxVId6NHp', 'DGlVrk8KL0', 'ToString', 'Wb9VMxA98E', 'y28VCOoJbB', 'BxaQYaYaJ5p7YgiDttw', 'hUXs4fY3fCmSojIpZeM', 'swZrCyY2AfjqaO2L7UG'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, zLRx0Krvxpl94Gmelc.cs	High entropy of concatenated method names: 'EQB4L53l8P', 'gnK4ZijvRb', 'foC4gMcnln', 'URD4ilVIrQ', 'MHI4mNNXXH', 'RXg4w8t06r', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, JV8COMjuieAqErQMuGa.cs	High entropy of concatenated method names: 'jPpRUlBDat', 'RCjR0ikxwX', 'hV5RpFi5pq', 'uIPNh1ovZZDc03eJ9OK', 'McMdE6oHLhe1bMWnNWV', 'oSuCUIok5xYAhNTgSrd'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	High entropy of concatenated method names: 'MZR5mbDnbO', 'sYs59UpbPG', 'ELE5Xl8Wmn', 'Gf25ISiCqV', 'kgg5rFZ9Zn', 'uXw5MmuTXG', 'ALS5C8Z78G', 'PeY5fAgDIq', 'sB25tZqQGv', 'yk55B2GSHp'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, D9EudLlbHv2APZOL2i.cs	High entropy of concatenated method names: 'CNbQJAcVb5', 's7uQPiP1Cs', 'qCwQ5Sp0qi', 'BVUQHwjPCD', 'ekFQjGeXhY', 'v30QVXIgIu', 'ud1Q2dwpK7', 'wnqQhrb0hj', 'BxDQOIYIJh', 'VtdQEP7W9w'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, j18cpQf7mkuHRbXFpl.cs	High entropy of concatenated method names: 'o272UcYVjI', 'IkQ20KqGI7', 'Bee2pXQMjH', 'eQj2DQTdAe', 'Vs82lUAkMh', 'eri2df75Ei', 'enW2xG6Nqv', 'S8j2NLVOuN', 'eTe2usWXRI', 'AN92Y3wW2o'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, A70MiS059eBQ79exbu.cs	High entropy of concatenated method names: 'xiNqN60YdT', 'LsBqutc1Jf', 'ih3qLluX1e', 'wygqZDmxIU', 'DZoqiQTcjH', 'IlpqwxYBX6', 'vFfqcvBwNL', 'Fbsq6YhC0F', 'l2oqom147T', 'r0qqAKAP8x'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, Fb16UU9rwEUap37uVW.cs	High entropy of concatenated method names: 'FO04PKlfRI', 'jtU45fpDLC', 'DBu4HERWIw', 'Ltb4jyWZr8', 'Bqo4VHukoc', 'KB942SWca1', 'X5n4hIjV45', 'SiG4OqU4E6', 'egg4E3Aepp', 'ScE4KkkTcJ'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, dYK3NXtpx6kd8ZccpM.cs	High entropy of concatenated method names: 'AHX2PbPYFU', 'KeI2H6kBnq', 'sFL2VyVWur', 'SKfVBCmeuB', 'HVUVz1l4Mo', 'HLO27IrPX5', 'CW328M4t48', 'kww2kq2nm0', 'Uxm2Q4Jw3K', 'oxT2n6vIIk'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, BoJSG7UDrVhUJiyNwB.cs	High entropy of concatenated method names: 'DpRTfK5287', 'y0XTB4lLio', 'jrN47Xag86', 'xqb48vHkqF', 'j1uTAE4QRk', 'kQDTaRHeAr', 'aECTF8Weda', 'TjKTmx7eui', 'qSuT9B5KRF', 'GFZTXiXn6X'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, eghuitF4yljFm0lKkM.cs	High entropy of concatenated method names: 'zZh82TnHuT', 'b8e8hMmqKB', 'FUu8EXaogP', 'KLJ8KekqrH', 'aFL8W4Tdeg', 'jLO8y34GqS', 'jwPwoL7htqxuauRScp', 'zYAZtv4O4FkTpx5eq8', 'kog881ZcJ9', 'Va58QI35Ca'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, RrYOk9jcPYBpJRwhDsY.cs	High entropy of concatenated method names: 'eAtSUwHgN2', 'LwrS0ieXrT', 'oZdSpgB5k3', 'pssSDPaBpW', 'VdMSlgpCkY', 'QoeSd330D1', 'tAgSxaElHl', 'CXiSNCPynd', 'omhSu8iVjP', 'qItSYsSmXe'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, qIHWAkuExOeaUujlqY.cs	High entropy of concatenated method names: 'WSgpEZ4MG', 'X6UDM5hF3', 'BfEdO9uBN', 'LRqxPSlJ5', 'vsku4ysYV', 'ghdYeYsQy', 'yl6Xhbv0h2JfbU7SqD', 'mZx6j6HlhTU3SgfsrJ', 'v9L4nd4Dp', 'eVJRli8Gy'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, JailI0yyD3oy9EWXGR.cs	High entropy of concatenated method names: 'nTaVJ9JO6e', 'SWjV5n3nAB', 'zXpVjSMBLu', 'RKbV2HJW6u', 'svEVhUYkvp', 'Yt8jr9vG3w', 'lwFjMpPhK0', 'qVQjCOCcbM', 'mMZjfc8u4e', 'Eehjtkoi7n'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, RbFpxOjX2gByO9bfJbc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9DRmYdvGC', 'O0XR93NS9h', 'm6wRXmrjtq', 'I2pRIsfTlx', 'O9ORrH7n5H', 'tCjRM8qwpH', 'b9URC6kjV5'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, mo2uG0YjKHD1aiAviU.cs	High entropy of concatenated method names: 'UvHTEHYYRJ', 'xR8TKpmMlK', 'ToString', 'A4ZTPOih7A', 'QkET5GVwmu', 'gu0THvvNke', 'YFXTjDiylY', 'gb4TVh1Q16', 'aFOT2UhtuD', 'vVmThxoyny'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, j6B1wyQDUGbllhbbhO.cs	High entropy of concatenated method names: 'VALS8kp83n', 'hvISQYk9SH', 'FsXSnrS7WN', 'VS4SPoOcB5', 'iMXS5uwhRi', 'Nm3SjJEEYI', 'L3mSVG9KxB', 'qEE4CCL2ZQ', 'E2a4fOuEEW', 'qCP4tSb5AP'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, CMxTafJa09SU85L67A.cs	High entropy of concatenated method names: 'esvjlLBaiq', 'jXGjx8b1RM', 'n7THglFIai', 'fgMHilYg5D', 'vOrHw7VjY1', 'qGvH1dRGHH', 'C2gHcxbfRd', 'lCTH6hxnQl', 'LouHbHacFB', 'H7jHoLOMJx'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, fYR6BysfY0DiREaAo2.cs	High entropy of concatenated method names: 'bgdHDJcNPO', 'J9yHdcj4VN', 'TxZHN31kqQ', 'pSiHuGeLiT', 'juRHWDlrnJ', 'HKYHyXayuI', 'xryHT3oB1K', 'in0H4pscok', 'Pf4HSvybJh', 'h2xHROBbm0'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, dMl8TwIyBpNEgmJauT.cs	High entropy of concatenated method names: 'MAjWoYxX44', 'JD4Wa9YnPK', 'paaWmQOT91', 'ecIW9tEfWO', 'DGjWZHl3We', 'fGmWgna66x', 'mx4WiedG3y', 'dfPWwhj2mN', 'U3KW1AwCCZ', 'QdFWcLbt4N'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, rOQN4VeudJysxd8645.cs	High entropy of concatenated method names: 'Dispose', 'n7n8tvTYUg', 'tEQkZNpeyR', 'FlJGGYUBaQ', 'xqv8BeqsIM', 'Xrd8zIRogm', 'ProcessDialogKey', 'wmOk7vSu2J', 'K0rk85TTNo', 'Rflkk4Vh95'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, c2cMNMpYDGGCdGPNCV.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fMnktTLXLy', 'f53kB1Hs3W', 'doAkzhdZEP', 'mUqQ75Unh6', 'tWcQ8Tq8ZZ', 'B3XQkgGALn', 'Sh9QQDBC6G', 'u1BxKpDoTTSW2HrvqNF'
Source: 0.2.UD61dgs2rz.exe.38efb90.2.raw.unpack, BET2H7355jyJGS9kPV.cs	High entropy of concatenated method names: 'WQXVXXtMaL', 'uZxVId6NHp', 'DGlVrk8KL0', 'ToString', 'Wb9VMxA98E', 'y28VCOoJbB', 'BxaQYaYaJ5p7YgiDttw', 'hUXs4fY3fCmSojIpZeM', 'swZrCyY2AfjqaO2L7UG'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, zLRx0Krvxpl94Gmelc.cs	High entropy of concatenated method names: 'EQB4L53l8P', 'gnK4ZijvRb', 'foC4gMcnln', 'URD4ilVIrQ', 'MHI4mNNXXH', 'RXg4w8t06r', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, JV8COMjuieAqErQMuGa.cs	High entropy of concatenated method names: 'jPpRUlBDat', 'RCjR0ikxwX', 'hV5RpFi5pq', 'uIPNh1ovZZDc03eJ9OK', 'McMdE6oHLhe1bMWnNWV', 'oSuCUIok5xYAhNTgSrd'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, EtsJobhTeXI6X3UQ5n.cs	High entropy of concatenated method names: 'MZR5mbDnbO', 'sYs59UpbPG', 'ELE5Xl8Wmn', 'Gf25ISiCqV', 'kgg5rFZ9Zn', 'uXw5MmuTXG', 'ALS5C8Z78G', 'PeY5fAgDIq', 'sB25tZqQGv', 'yk55B2GSHp'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, D9EudLlbHv2APZOL2i.cs	High entropy of concatenated method names: 'CNbQJAcVb5', 's7uQPiP1Cs', 'qCwQ5Sp0qi', 'BVUQHwjPCD', 'ekFQjGeXhY', 'v30QVXIgIu', 'ud1Q2dwpK7', 'wnqQhrb0hj', 'BxDQOIYIJh', 'VtdQEP7W9w'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, j18cpQf7mkuHRbXFpl.cs	High entropy of concatenated method names: 'o272UcYVjI', 'IkQ20KqGI7', 'Bee2pXQMjH', 'eQj2DQTdAe', 'Vs82lUAkMh', 'eri2df75Ei', 'enW2xG6Nqv', 'S8j2NLVOuN', 'eTe2usWXRI', 'AN92Y3wW2o'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, A70MiS059eBQ79exbu.cs	High entropy of concatenated method names: 'xiNqN60YdT', 'LsBqutc1Jf', 'ih3qLluX1e', 'wygqZDmxIU', 'DZoqiQTcjH', 'IlpqwxYBX6', 'vFfqcvBwNL', 'Fbsq6YhC0F', 'l2oqom147T', 'r0qqAKAP8x'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, Fb16UU9rwEUap37uVW.cs	High entropy of concatenated method names: 'FO04PKlfRI', 'jtU45fpDLC', 'DBu4HERWIw', 'Ltb4jyWZr8', 'Bqo4VHukoc', 'KB942SWca1', 'X5n4hIjV45', 'SiG4OqU4E6', 'egg4E3Aepp', 'ScE4KkkTcJ'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, dYK3NXtpx6kd8ZccpM.cs	High entropy of concatenated method names: 'AHX2PbPYFU', 'KeI2H6kBnq', 'sFL2VyVWur', 'SKfVBCmeuB', 'HVUVz1l4Mo', 'HLO27IrPX5', 'CW328M4t48', 'kww2kq2nm0', 'Uxm2Q4Jw3K', 'oxT2n6vIIk'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, BoJSG7UDrVhUJiyNwB.cs	High entropy of concatenated method names: 'DpRTfK5287', 'y0XTB4lLio', 'jrN47Xag86', 'xqb48vHkqF', 'j1uTAE4QRk', 'kQDTaRHeAr', 'aECTF8Weda', 'TjKTmx7eui', 'qSuT9B5KRF', 'GFZTXiXn6X'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, eghuitF4yljFm0lKkM.cs	High entropy of concatenated method names: 'zZh82TnHuT', 'b8e8hMmqKB', 'FUu8EXaogP', 'KLJ8KekqrH', 'aFL8W4Tdeg', 'jLO8y34GqS', 'jwPwoL7htqxuauRScp', 'zYAZtv4O4FkTpx5eq8', 'kog881ZcJ9', 'Va58QI35Ca'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, RrYOk9jcPYBpJRwhDsY.cs	High entropy of concatenated method names: 'eAtSUwHgN2', 'LwrS0ieXrT', 'oZdSpgB5k3', 'pssSDPaBpW', 'VdMSlgpCkY', 'QoeSd330D1', 'tAgSxaElHl', 'CXiSNCPynd', 'omhSu8iVjP', 'qItSYsSmXe'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, qIHWAkuExOeaUujlqY.cs	High entropy of concatenated method names: 'WSgpEZ4MG', 'X6UDM5hF3', 'BfEdO9uBN', 'LRqxPSlJ5', 'vsku4ysYV', 'ghdYeYsQy', 'yl6Xhbv0h2JfbU7SqD', 'mZx6j6HlhTU3SgfsrJ', 'v9L4nd4Dp', 'eVJRli8Gy'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, JailI0yyD3oy9EWXGR.cs	High entropy of concatenated method names: 'nTaVJ9JO6e', 'SWjV5n3nAB', 'zXpVjSMBLu', 'RKbV2HJW6u', 'svEVhUYkvp', 'Yt8jr9vG3w', 'lwFjMpPhK0', 'qVQjCOCcbM', 'mMZjfc8u4e', 'Eehjtkoi7n'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, RbFpxOjX2gByO9bfJbc.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9DRmYdvGC', 'O0XR93NS9h', 'm6wRXmrjtq', 'I2pRIsfTlx', 'O9ORrH7n5H', 'tCjRM8qwpH', 'b9URC6kjV5'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, mo2uG0YjKHD1aiAviU.cs	High entropy of concatenated method names: 'UvHTEHYYRJ', 'xR8TKpmMlK', 'ToString', 'A4ZTPOih7A', 'QkET5GVwmu', 'gu0THvvNke', 'YFXTjDiylY', 'gb4TVh1Q16', 'aFOT2UhtuD', 'vVmThxoyny'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, j6B1wyQDUGbllhbbhO.cs	High entropy of concatenated method names: 'VALS8kp83n', 'hvISQYk9SH', 'FsXSnrS7WN', 'VS4SPoOcB5', 'iMXS5uwhRi', 'Nm3SjJEEYI', 'L3mSVG9KxB', 'qEE4CCL2ZQ', 'E2a4fOuEEW', 'qCP4tSb5AP'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, CMxTafJa09SU85L67A.cs	High entropy of concatenated method names: 'esvjlLBaiq', 'jXGjx8b1RM', 'n7THglFIai', 'fgMHilYg5D', 'vOrHw7VjY1', 'qGvH1dRGHH', 'C2gHcxbfRd', 'lCTH6hxnQl', 'LouHbHacFB', 'H7jHoLOMJx'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, fYR6BysfY0DiREaAo2.cs	High entropy of concatenated method names: 'bgdHDJcNPO', 'J9yHdcj4VN', 'TxZHN31kqQ', 'pSiHuGeLiT', 'juRHWDlrnJ', 'HKYHyXayuI', 'xryHT3oB1K', 'in0H4pscok', 'Pf4HSvybJh', 'h2xHROBbm0'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, dMl8TwIyBpNEgmJauT.cs	High entropy of concatenated method names: 'MAjWoYxX44', 'JD4Wa9YnPK', 'paaWmQOT91', 'ecIW9tEfWO', 'DGjWZHl3We', 'fGmWgna66x', 'mx4WiedG3y', 'dfPWwhj2mN', 'U3KW1AwCCZ', 'QdFWcLbt4N'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, rOQN4VeudJysxd8645.cs	High entropy of concatenated method names: 'Dispose', 'n7n8tvTYUg', 'tEQkZNpeyR', 'FlJGGYUBaQ', 'xqv8BeqsIM', 'Xrd8zIRogm', 'ProcessDialogKey', 'wmOk7vSu2J', 'K0rk85TTNo', 'Rflkk4Vh95'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, c2cMNMpYDGGCdGPNCV.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'fMnktTLXLy', 'f53kB1Hs3W', 'doAkzhdZEP', 'mUqQ75Unh6', 'tWcQ8Tq8ZZ', 'B3XQkgGALn', 'Sh9QQDBC6G', 'u1BxKpDoTTSW2HrvqNF'
Source: 0.2.UD61dgs2rz.exe.39a69b0.3.raw.unpack, BET2H7355jyJGS9kPV.cs	High entropy of concatenated method names: 'WQXVXXtMaL', 'uZxVId6NHp', 'DGlVrk8KL0', 'ToString', 'Wb9VMxA98E', 'y28VCOoJbB', 'BxaQYaYaJ5p7YgiDttw', 'hUXs4fY3fCmSojIpZeM', 'swZrCyY2AfjqaO2L7UG'

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004063C6 ShellExecuteW,URLDownloadToFileW,

14_2_004063C6

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

File created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpC22F.tmp"

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00418A00 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

14_2_00418A00

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

14_2_0041A8DA

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR

Delayed program exit found

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0040E18D Sleep,ExitProcess,

14_2_0040E18D

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 24E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 7280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 8280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 8430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory allocated: 9430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 2900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 75D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 85D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 8770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory allocated: 9770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

14_2_004186FE

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6227	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1034	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5598	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1303	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Window / User API: threadDelayed 6381	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Window / User API: threadDelayed 3615	Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

API coverage: 4.9 %

Source: C:\Users\user\Desktop\UD61dgs2rz.exe TID: 1656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7504	Thread sleep count: 5598 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 1303 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe TID: 7560	Thread sleep count: 6381 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe TID: 7560	Thread sleep time: -19143000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe TID: 7560	Thread sleep count: 3615 > 30	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe TID: 7560	Thread sleep time: -10845000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe TID: 7696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0041A01B FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	14_2_0041A01B
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040B28E FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	14_2_0040B28E
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040838E __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_0040838E
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004087A0 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	14_2_004087A0
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00407848 __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	14_2_00407848
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004068CD FindFirstFileW,FindNextFileW,	14_2_004068CD
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0044BA59 FindFirstFileExA,	14_2_0044BA59
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040AA71 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00417AAB FindFirstFileW,FindNextFileW,FindNextFileW,	14_2_00417AAB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_0040AC78 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	14_2_0040AC78

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00406D28 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

14_2_00406D28

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: HODoCxSdp.exe, 0000000A.00000002.2230054812.000000000705D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_004327AE

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

14_2_0041A8DA

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004407B5 mov eax, dword ptr fs:[00000030h]

14_2_004407B5

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_00410763 SetLastError,GetNativeSystemInfo,SetLastError,GetProcessHeap,HeapAlloc,SetLastError,

14_2_00410763

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004327AE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004327AE
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004328FC SetUnhandledExceptionFilter,	14_2_004328FC
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_004398AC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_004398AC
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: 14_2_00432D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_00432D5C

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Memory allocated: page read and write | page guard

Adds a directory exclusion to Windows Defender

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Memory written: C:\Users\user\Desktop\UD61dgs2rz.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Memory written: C:\Users\user\AppData\Roaming\HODoCxSdp.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

14_2_00410B5C

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004175E1 mouse_event,

14_2_004175E1

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpC22F.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Process created: C:\Users\user\Desktop\UD61dgs2rz.exe "C:\Users\user\Desktop\UD61dgs2rz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpD46F.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Process created: C:\Users\user\AppData\Roaming\HODoCxSdp.exe "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"	Jump to behavior

Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager"
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerq
Source: UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp, UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004329DA cpuid

14_2_004329DA

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: EnumSystemLocalesW,	14_2_0044F17B
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: EnumSystemLocalesW,	14_2_0044F130
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: EnumSystemLocalesW,	14_2_0044F216
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F2A3
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoA,	14_2_0040E2BB
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoW,	14_2_0044F4F3
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0044F61C
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoW,	14_2_0044F723
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0044F7F0
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: EnumSystemLocalesW,	14_2_00445914
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: GetLocaleInfoW,	14_2_00445E1C
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	14_2_0044EEB8

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Users\user\Desktop\UD61dgs2rz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Queries volume information: C:\Users\user\AppData\Roaming\HODoCxSdp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_0040A0B0 GetLocalTime,wsprintfW,

14_2_0040A0B0

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004195F8 GetUserNameW,

14_2_004195F8

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: 14_2_004466BF _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

14_2_004466BF

Source: C:\Users\user\Desktop\UD61dgs2rz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2197786692.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

14_2_0040A953

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		14_2_0040AA71
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Code function: \key3.db		14_2_0040AA71

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\Desktop\UD61dgs2rz.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-O7QOC3			Jump to behavior
Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-O7QOC3			Jump to behavior

Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HODoCxSdp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3bc3d48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.35c2f70.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.HODoCxSdp.exe.3b4e728.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UD61dgs2rz.exe.354d950.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2197786692.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 3064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: UD61dgs2rz.exe PID: 7524, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HODoCxSdp.exe PID: 7948, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Code function: cmd.exe

14_2_0040567A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Windows Service	4 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	Login Hook	122 Process Injection	12 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	33 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	121 Security Software Discovery	VNC	GUI Input Capture	12 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	122 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UD61dgs2rz.exe	42%	ReversingLabs	Win32.Backdoor.Remcos
UD61dgs2rz.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\HODoCxSdp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\HODoCxSdp.exe	42%	ReversingLabs	Win32.Backdoor.Remcos

Source	Detection	Scanner	Label
http://geoplugin.net/json.gp	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
204.10.160.230	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp:	0%	Avira URL Cloud	safe
http://geoplugin.net/-6	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp?	0%	Avira URL Cloud	safe
http://geoplugin.net/	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gpSystem32	0%	Avira URL Cloud	safe
http://geoplugin.net/N	0%	Avira URL Cloud	safe
http://geoplugin.net/json.gp6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geoplugin.net	178.237.33.50	true	false		unknown
171.39.242.20.in-addr.arpa	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
204.10.160.230	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/N	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp6	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F3D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp/C	UD61dgs2rz.exe, 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	UD61dgs2rz.exe, 00000000.00000002.2170083571.00000000024E1000.00000004.00000800.00020000.00000000.sdmp, HODoCxSdp.exe, 0000000A.00000002.2223615700.0000000002AE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	UD61dgs2rz.exe, HODoCxSdp.exe.0.dr	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp:	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/-6	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gpSystem32	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp?	UD61dgs2rz.exe, 00000009.00000002.4594472847.0000000000F4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.237.33.50	geoplugin.net	Netherlands		8455	ATOM86-ASATOM86NL	false
204.10.160.230	unknown	Canada		64236	UNREAL-SERVERSUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483007
Start date and time:	2024-07-26 13:47:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UD61dgs2rz.exe renamed because original name is a hash value
Original Sample Name:	3f69729a8f2b22e625bb984f28758ebc.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@19/16@2/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 63 Number of non-executed functions: 195
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target UD61dgs2rz.exe, PID 7524 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: UD61dgs2rz.exe

Simulations

Behavior and APIs

Time	Type	Description
07:48:11	API Interceptor	5342750x Sleep call for process: UD61dgs2rz.exe modified
07:48:13	API Interceptor	38x Sleep call for process: powershell.exe modified
07:48:16	API Interceptor	2x Sleep call for process: HODoCxSdp.exe modified
13:48:14	Task Scheduler	Run new task: HODoCxSdp path: C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
178.237.33.50	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	geoplugin.net/json.gp
	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	Quotation.xls	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
204.10.160.230	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse
	CDG__ Copia de Pagamento.pdf.exe	Get hash	malicious	Remcos	Browse
	Banco_BPM__Copia_del_Pagamento.pdf.bat	Get hash	malicious	Remcos	Browse
	BBVA Colombia__ Aviso de Pago.pdf.bat.exe	Get hash	malicious	Remcos	Browse
	Aviso de Pago __Banco Republica.pdf.bat.exe	Get hash	malicious	Remcos	Browse
	Payment Advice__Swift-MT103.pdf.bat.exe	Get hash	malicious	Remcos	Browse
	UniCredit__Avviso di Pagamento.pdf.bat.exe	Get hash	malicious	Remcos	Browse
	Documento di Pagamento_Intesa Sanpaolo_pdf.bat.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
geoplugin.net	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	178.237.33.50
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	178.237.33.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATOM86-ASATOM86NL	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	178.237.33.50
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	178.237.33.50
	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	178.237.33.50
	C1ZsNxSer8.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	Quotation.xls	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_101.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_407.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
	LisectAVT_2403002A_431.exe	Get hash	malicious	Remcos	Browse	178.237.33.50
UNREAL-SERVERSUS	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse	204.10.160.230
	CDG__ Copia de Pagamento.pdf.exe	Get hash	malicious	Remcos	Browse	204.10.160.230
	LisectAVT_2403002C_9.exe	Get hash	malicious	Remcos	Browse	212.162.149.217
	DRAFT AWB and DRAFT Commercial invoice.xls	Get hash	malicious	Remcos	Browse	162.251.122.70
	XrAADcYten.rtf	Get hash	malicious	Remcos	Browse	162.251.122.76
	iWRmEn1DDT.rtf	Get hash	malicious	Remcos	Browse	204.10.160.144
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.14325.16174.rtf	Get hash	malicious	Remcos	Browse	162.251.122.70
	Payment Copy.xls	Get hash	malicious	Remcos	Browse	204.10.160.144
	Chemicals list 0724.exe	Get hash	malicious	Remcos, GuLoader	Browse	212.162.149.85
	RFQPO3D93876738.scr.exe	Get hash	malicious	AgentTesla, RedLine, XWorm	Browse	212.162.149.48

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\HODoCxSdp.exe	Payment Advice__HSBC Banking.pdf.lnk	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HODoCxSdp.exe.log

Process:	C:\Users\user\AppData\Roaming\HODoCxSdp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLV1qE4jE4K5E4KlKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:Mp1qHjHK5HKlYHKh3oPtHo6hAHKze0HJ
MD5:	B3F9683FD57A94D3C3F5E1AEC259CEAD
SHA1:	EC2310112CBA894207F624FCC35E9C0FCE80EE2F
SHA-256:	97FC8E1E4A9D08C91DEC78055942F0562C6EEC2480F5DDA2E7A9E9358AC86F94
SHA-512:	37407216C4E44C3FFF758637D4661AA9CCAC1C34C9AFEDEAF4ACEFEE8F527921046004F90CD2AE304E1A0EAFB636AC7F0DDBCED579C6642E7C32746491E854F2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UD61dgs2rz.exe.log

Process:	C:\Users\user\Desktop\UD61dgs2rz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLV1qE4jE4K5E4KlKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:Mp1qHjHK5HKlYHKh3oPtHo6hAHKze0HJ
MD5:	B3F9683FD57A94D3C3F5E1AEC259CEAD
SHA1:	EC2310112CBA894207F624FCC35E9C0FCE80EE2F
SHA-256:	97FC8E1E4A9D08C91DEC78055942F0562C6EEC2480F5DDA2E7A9E9358AC86F94
SHA-512:	37407216C4E44C3FFF758637D4661AA9CCAC1C34C9AFEDEAF4ACEFEE8F527921046004F90CD2AE304E1A0EAFB636AC7F0DDBCED579C6642E7C32746491E854F2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

Process:	C:\Users\user\Desktop\UD61dgs2rz.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.012309356796613
Encrypted:	false
SSDEEP:	12:tklu+mnd66GkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qlu+KdbauKyGX85jvXhNlT3/7AcV9Wro
MD5:	14B479958E659C5A4480548A393022AC
SHA1:	CD0766C1DAB80656D469ABDB22917BE668622015
SHA-256:	0F92BDD807D2F5C9947E1775A20231233043C171F62E1AFA705A7E7938909BFE
SHA-512:	4E87CA47392DD9710F9E3D4A2124A34B41938986A4F43D50A48623DB1838C0D6CFF05FD2A23792DCD5A974A94416C97DC04ECEF85025FC785F3393B69A0B1DC5
Malicious:	false
Preview:	{. "geoplugin_request":"8.46.123.33",. "geoplugin_status":200,. "geoplugin_delay":"0ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7123",. "geoplugin_longitude":"-74.0068",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379552885213346
Encrypted:	false
SSDEEP:	48:fWSU4xympjgs4RIoU99tK8NPZHUl7u1iMugeC/ZM0Uyus:fLHxvCsIfA2KRHmOugw1s
MD5:	3E5712DC6AFCA8CF60C5CB8BE65E2089
SHA1:	CDBAF3935912EFB05DBE58CA89C5422F07B528A0
SHA-256:	B9F7E5F0AFD718D8585A8B37DD8C459ECDD4E7E68C5FE61631D89CDD3E229833
SHA-512:	1BD81033EB26CD0EE3DEF6F02FECB4097D878D61CAA5BEF6739C51E889B99C9E695BECF51719959D33F7BA9838E202ADD7EE4DD704D5163B584F4E8B8B7ECC38
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_05fyhmbz.5bq.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5f4u2fzh.ljg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aolmdvef.h5l.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bmeaug3f.3vt.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hs0q00c4.s03.psm1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2y5hn5h.e5a.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sdfpmxpk.gjq.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xb4hpvfb.qjg.ps1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpC22F.tmp

Process:	C:\Users\user\Desktop\UD61dgs2rz.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	5.101247331289632
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt6xvn:cgergYrFdOFzOzN33ODOiDdKrsuTOv
MD5:	A67D49ECA26CE3A58CDEA1F14A586702
SHA1:	CA04A2BDAA4D9D634AE2B025E060D3D0C3B2E5C9
SHA-256:	B7D04D7DC61D6C8D129CEB9EFF84C78FF08819BA979F7B53DD33E7EDE284FB96
SHA-512:	2B0234A20E0B37EEF8151077F2A290974B56D23402E36E10DABA1C1BD82E546924FAB9A14554650D43B452F67CEDC95348DA45112D717830F280CE7CF6BB4E8C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Local\Temp\tmpD46F.tmp

Process:	C:\Users\user\AppData\Roaming\HODoCxSdp.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	5.101247331289632
Encrypted:	false
SSDEEP:	24:2di4+S2qhlZ1Muy1my3UnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNt6xvn:cgergYrFdOFzOzN33ODOiDdKrsuTOv
MD5:	A67D49ECA26CE3A58CDEA1F14A586702
SHA1:	CA04A2BDAA4D9D634AE2B025E060D3D0C3B2E5C9
SHA-256:	B7D04D7DC61D6C8D129CEB9EFF84C78FF08819BA979F7B53DD33E7EDE284FB96
SHA-512:	2B0234A20E0B37EEF8151077F2A290974B56D23402E36E10DABA1C1BD82E546924FAB9A14554650D43B452F67CEDC95348DA45112D717830F280CE7CF6BB4E8C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetwor

C:\Users\user\AppData\Roaming\HODoCxSdp.exe

Process:	C:\Users\user\Desktop\UD61dgs2rz.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	961544
Entropy (8bit):	7.9046329365332095
Encrypted:	false
SSDEEP:	24576:Yglv8Jv17LLE1hUG+n1KD9Wa9PMEgDzx9mZREOUqqHXONlVUE:oPYf+n1KDghPx9ARDhqHXOR
MD5:	3F69729A8F2B22E625BB984F28758EBC
SHA1:	AB8AAB5952DFCF0D705DAFF76448920C67B6241D
SHA-256:	D1B50FC6CE79320A88DEFEF33BAF6A51E30845BD13AB2B52F7925BA0B8F527CD
SHA-512:	C4622E82F66AA728DED76EF628BD31DDCD35581A10A6043E735E557A26C8F9C72C67713F29A3ED90F647BF268484B44CF812918A02AA8E1539C3FDAC7BCC1FA1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Joe Sandbox View:	Filename: Payment Advice__HSBC Banking.pdf.lnk, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................l............... ........@.. ....................................@.................................p...K....................v...6........................................................... ............... ..H............text....j... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B........................H...................m....................................................0.......... .........%.?...(.....@... .........%.[...(.....\... .........%.....(......... .........%.....(......... .........%.:...(.....;...(H........&.&.(.........0..........~......~...........E........"...V...".......C....~.........,... ........w.Y..+..+..r...p.....(....o....s.............. ..... Y;..Y..+.~.........0...........~........."...........0...........(....r;..p~....o......t......*.6(H.

C:\Users\user\AppData\Roaming\HODoCxSdp.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\UD61dgs2rz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:
Entropy (8bit):	7.9046329365332095
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UD61dgs2rz.exe
File size:	961'544 bytes
MD5:	3f69729a8f2b22e625bb984f28758ebc
SHA1:	ab8aab5952dfcf0d705daff76448920c67b6241d
SHA256:	d1b50fc6ce79320a88defef33baf6a51e30845bd13ab2b52f7925ba0b8f527cd
SHA512:	c4622e82f66aa728ded76ef628bd31ddcd35581a10a6043e735e557a26c8f9c72c67713f29a3ed90f647bf268484b44cf812918a02aa8e1539c3fdac7bcc1fa1
SSDEEP:	24576:Yglv8Jv17LLE1hUG+n1KD9Wa9PMEgDzx9mZREOUqqHXONlVUE:oPYf+n1KDghPx9ARDhqHXOR
TLSH:	9915122D8B225F17CFBD0BB8A4412015077AA066F266F72F29C1C4FD1D51FF881A6A93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................l............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-26T13:48:17.448620+0200	TCP	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	49730	80	192.168.2.5	178.237.33.50
2024-07-26T13:48:51.687437+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	54732	40.127.169.103	192.168.2.5
2024-07-26T13:48:15.533075+0200	TCP	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	49725	7983	192.168.2.5	204.10.160.230
2024-07-26T13:48:49.721672+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	54731	40.127.169.103	192.168.2.5
2024-07-26T13:48:31.403250+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49737	20.114.59.183	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:48:14.571439981 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:14.576597929 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:14.576729059 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:14.581968069 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:14.586852074 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:15.488145113 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:15.533075094 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:15.624773979 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:15.629177094 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:15.634040117 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:15.634130001 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:15.638988018 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:16.163506985 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:16.204957962 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:16.285514116 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:16.290935040 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:16.297980070 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:16.345576048 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:16.806446075 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:48:16.811340094 CEST	80	49730	178.237.33.50	192.168.2.5
Jul 26, 2024 13:48:16.811395884 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:48:16.811815023 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:48:16.816692114 CEST	80	49730	178.237.33.50	192.168.2.5
Jul 26, 2024 13:48:17.448548079 CEST	80	49730	178.237.33.50	192.168.2.5
Jul 26, 2024 13:48:17.448620081 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:48:17.458848953 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:17.511995077 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:18.620531082 CEST	80	49730	178.237.33.50	192.168.2.5
Jul 26, 2024 13:48:18.620588064 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:48:51.434425116 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:48:51.435789108 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:48:51.442425966 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:49:26.801454067 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:49:26.802834034 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:49:26.807950020 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:50:02.621690035 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:50:02.625957012 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:50:02.631016970 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:50:06.720726967 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:07.032932997 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:07.642427921 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:08.845635891 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:11.251657963 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:16.064204931 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:25.673613071 CEST	49730	80	192.168.2.5	178.237.33.50
Jul 26, 2024 13:50:39.185075045 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:50:39.188445091 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:50:39.193761110 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:51:17.287810087 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:51:17.288835049 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:51:17.295747995 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:51:54.240680933 CEST	7983	49725	204.10.160.230	192.168.2.5
Jul 26, 2024 13:51:54.241894007 CEST	49725	7983	192.168.2.5	204.10.160.230
Jul 26, 2024 13:51:54.246989012 CEST	7983	49725	204.10.160.230	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2024 13:48:16.782485008 CEST	56511	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:48:16.790401936 CEST	53	56511	1.1.1.1	192.168.2.5
Jul 26, 2024 13:48:45.090811968 CEST	53	51971	162.159.36.2	192.168.2.5
Jul 26, 2024 13:48:45.567487955 CEST	49787	53	192.168.2.5	1.1.1.1
Jul 26, 2024 13:48:45.590920925 CEST	53	49787	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 26, 2024 13:48:16.782485008 CEST	192.168.2.5	1.1.1.1	0x368d	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:48:45.567487955 CEST	192.168.2.5	1.1.1.1	0x8438	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 26, 2024 13:48:16.790401936 CEST	1.1.1.1	192.168.2.5	0x368d	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Jul 26, 2024 13:48:45.590920925 CEST	1.1.1.1	192.168.2.5	0x8438	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49730	178.237.33.50	80	7524	C:\Users\user\Desktop\UD61dgs2rz.exe

Timestamp	Bytes transferred	Direction	Data
Jul 26, 2024 13:48:16.811815023 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Jul 26, 2024 13:48:17.448548079 CEST	1170	IN	HTTP/1.1 200 OK date: Fri, 26 Jul 2024 11:48:17 GMT server: Apache content-length: 962 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 30 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f [TRUNCATED] Data Ascii: { "geoplugin_request":"8.46.123.33", "geoplugin_status":200, "geoplugin_delay":"0ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7123", "geoplugin_longitude":"-74.0068", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

Target ID:	0
Start time:	07:48:11
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\UD61dgs2rz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UD61dgs2rz.exe"
Imagebase:	0x10000
File size:	961'544 bytes
MD5 hash:	3F69729A8F2B22E625BB984F28758EBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2171071902.000000000354D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Target ID:	3
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\UD61dgs2rz.exe"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HODoCxSdp.exe"
Imagebase:	0x5e0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpC22F.tmp"
Imagebase:	0x230000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	07:48:12
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	07:48:13
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\UD61dgs2rz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UD61dgs2rz.exe"
Imagebase:	0x7a0000
File size:	961'544 bytes
MD5 hash:	3F69729A8F2B22E625BB984F28758EBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000009.00000002.4594472847.0000000000EF7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	07:48:14
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\HODoCxSdp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\HODoCxSdp.exe
Imagebase:	0x740000
File size:	961'544 bytes
MD5 hash:	3F69729A8F2B22E625BB984F28758EBC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000002.2226007539.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	07:48:15
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	12
Start time:	07:48:18
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HODoCxSdp" /XML "C:\Users\user\AppData\Local\Temp\tmpD46F.tmp"
Imagebase:	0x230000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	13
Start time:	07:48:18
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	14
Start time:	07:48:18
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Roaming\HODoCxSdp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\HODoCxSdp.exe"
Imagebase:	0xe40000
File size:	961'544 bytes
MD5 hash:	3F69729A8F2B22E625BB984F28758EBC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2197786692.00000000014CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer, Description: detects Windows exceutables potentially bypassing UAC using eventvwr.exe, Source: 0000000E.00000002.2196279495.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true