Windows Analysis Report
f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe

Overview

General Information

Sample name: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
Analysis ID: 1483220
MD5: 284bba6223d9215b7b1f9b99480ad2cd
SHA1: 5fd4f669024dce37ae01d3976d247d599c5e7f8e
SHA256: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b01582d140d17d8131f658d
Tags: exeRedLineStealer
Infos:

Detection

RedLine
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Search for Antivirus process
Yara detected RedLine Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Found stalling execution ending in API Sleep call
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Sigma detected: WScript or CScript Dropper
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript called in batch mode (surpress errors)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE / OLE file has an invalid certificate
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Found malware configuration
Source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: RedLine {"C2 url": "88.99.151.68:7200", "Bot Id": "linkedin721", "Authorization Header": "147e49efa850c08896c9699376e24ce5"}
Multi AV Scanner detection for submitted file
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe ReversingLabs: Detection: 66%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Uses 32bit PE files
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A34005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00A34005
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3494A GetFileAttributesW,FindFirstFileW,FindClose, 11_2_00A3494A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A33CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00A33CE2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00A3C2FF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 11_2_00A3CD9F
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3CD14 FindFirstFileW,FindClose, 11_2_00A3CD14
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00A3F5D8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00A3F735
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00A3FA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_001E4005
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E494A GetFileAttributesW,FindFirstFileW,FindClose, 16_2_001E494A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_001EC2FF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ECD14 FindFirstFileW,FindClose, 16_2_001ECD14
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 16_2_001ECD9F
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_001EF5D8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_001EF735
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_001EFA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_001E3CE2

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 88.99.151.68:7200
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A429BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 11_2_00A429BA
Source: global traffic DNS traffic detected: DNS query: RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://ocsp.sectigo.com0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2017160041.000000000283A000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000000.2068027405.0000000000A99000.00000002.00000001.01000000.00000005.sdmp, ApolloSphere.pif, 00000010.00000002.3254047841.0000000000249000.00000002.00000001.01000000.00000008.sdmp, ApolloSphere.pif.11.dr, Flash.pif.2.dr, Parents.0.dr String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Flash.pif, 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe String found in binary or memory: https://sectigo.com/CPS0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Flash.pif.2.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2025611009.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B9A000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3257234453.00000000039E0000.00000004.00000800.00020000.00000000.sdmp, Flash.pif, 0000000B.00000003.3247044390.00000000039D1000.00000004.00000800.00020000.00000000.sdmp, Confidentiality.0.dr, ApolloSphere.pif.11.dr, Flash.pif.2.dr String found in binary or memory: https://www.globalsign.com/repository/06
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004050CD
Contains functionality to modify clipboard data
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A44830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 11_2_00A44830
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001F4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 16_2_001F4830
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A44632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 11_2_00A44632
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Potential key logger detected (key state polling based)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A5D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 11_2_00A5D164
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0020D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 16_2_0020D164

System Summary
barindex
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Wscript called in batch mode (surpress errors)
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A342D5: CreateFileW,DeviceIoControl,CloseHandle, 11_2_00A342D5
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A28F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 11_2_00A28F2E
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx, 0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A35778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 11_2_00A35778
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 16_2_001E5778
Detected potential crypto function
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_0040497C 0_2_0040497C
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00406ED2 0_2_00406ED2
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004074BB 0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009DB020 11_2_009DB020
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009D94E0 11_2_009D94E0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009D9C80 11_2_009D9C80
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F23F5 11_2_009F23F5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A58400 11_2_00A58400
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A06502 11_2_00A06502
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009DE6F0 11_2_009DE6F0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A0265E 11_2_00A0265E
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F282A 11_2_009F282A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A089BF 11_2_00A089BF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A50A3A 11_2_00A50A3A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A06A74 11_2_00A06A74
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009E0BE0 11_2_009E0BE0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A2EDB2 11_2_00A2EDB2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FCD51 11_2_009FCD51
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A50EB7 11_2_00A50EB7
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A38E44 11_2_00A38E44
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A06FE6 11_2_00A06FE6
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F33B7 11_2_009F33B7
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FF409 11_2_009FF409
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009ED45D 11_2_009ED45D
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F16B4 11_2_009F16B4
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009DF6A0 11_2_009DF6A0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009EF628 11_2_009EF628
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009D1663 11_2_009D1663
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F78C3 11_2_009F78C3
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F1BA8 11_2_009F1BA8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FDBA5 11_2_009FDBA5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A09CE5 11_2_00A09CE5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009EDD28 11_2_009EDD28
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FBFD6 11_2_009FBFD6
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F1FC0 11_2_009F1FC0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0018B020 16_2_0018B020
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001894E0 16_2_001894E0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00189C80 16_2_00189C80
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A23F5 16_2_001A23F5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00208400 16_2_00208400
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B6502 16_2_001B6502
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B265E 16_2_001B265E
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0018E6F0 16_2_0018E6F0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A282A 16_2_001A282A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B89BF 16_2_001B89BF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00200A3A 16_2_00200A3A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B6A74 16_2_001B6A74
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00190BE0 16_2_00190BE0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ACD51 16_2_001ACD51
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001DEDB2 16_2_001DEDB2
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E8E44 16_2_001E8E44
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00200EB7 16_2_00200EB7
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B6FE6 16_2_001B6FE6
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A33B7 16_2_001A33B7
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001AF409 16_2_001AF409
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0019D45D 16_2_0019D45D
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0019F628 16_2_0019F628
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00181663 16_2_00181663
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A16B4 16_2_001A16B4
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0018F6A0 16_2_0018F6A0
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A78C3 16_2_001A78C3
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A1BA8 16_2_001A1BA8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ADBA5 16_2_001ADBA5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001B9CE5 16_2_001B9CE5
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_0019DD28 16_2_0019DD28
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ABFD6 16_2_001ABFD6
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A1FC0 16_2_001A1FC0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 865347471135BB5459AD0E647E75A14AD91424B6F13A5C05D9ECD9183A8A1CF4
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: String function: 009F8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: String function: 009E1A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: String function: 009F0D17 appears 70 times
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: String function: 00191A36 appears 34 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: String function: 001A8B30 appears 42 times
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: String function: 001A0D17 appears 70 times
PE / OLE file has an invalid certificate
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2017160041.000000000283A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAutoIt3.exeB vs f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe
Uses 32bit PE files
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal100.troj.evad.winEXE@30/37@2/0
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3A6AD GetLastError,FormatMessageW, 11_2_00A3A6AD
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A28DE9 AdjustTokenPrivileges,CloseHandle, 11_2_00A28DE9
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A29399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 11_2_00A29399
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001D8DE9 AdjustTokenPrivileges,CloseHandle, 16_2_001D8DE9
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001D9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 16_2_001D9399
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004044A5
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A34148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification, 11_2_00A34148
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004024FB CoCreateInstance, 0_2_004024FB
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx, 11_2_00A3443D
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif File created: C:\Users\user\AppData\Local\EduTech Dynamics Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe File created: C:\Users\user\AppData\Local\Temp\nslC0B5.tmp Jump to behavior
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe File read: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe "C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe"
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L"
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L" Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: jscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000014.00000000.3250004113.0000000000D02000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe.11.dr
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F8B75 push ecx; ret 11_2_009F8B88
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001A8B75 push ecx; ret 16_2_001A8B88

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif File created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Jump to dropped file
Drops PE files
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif File created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif File created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "ApolloSphere" /tr "wscript //B 'C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.js'" /sc onlogon /F /RL HIGHEST
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A559B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 11_2_00A559B3
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009E5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 11_2_009E5EDA
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_002059B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 16_2_002059B3
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_00195EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 16_2_00195EDA
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_009F33B7
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found stalling execution ending in API Sleep call
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Stalling execution: Execution stalls by calling Sleep
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif API coverage: 4.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\timeout.exe TID: 5672 Thread sleep count: 115 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004062D5 FindFirstFileW,FindClose, 0_2_004062D5
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00402E18 FindFirstFileW, 0_2_00402E18
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW, 0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A34005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00A34005
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3494A GetFileAttributesW,FindFirstFileW,FindClose, 11_2_00A3494A
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A33CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 11_2_00A33CE2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00A3C2FF
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 11_2_00A3CD9F
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3CD14 FindFirstFileW,FindClose, 11_2_00A3CD14
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00A3F5D8
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 11_2_00A3F735
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A3FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 11_2_00A3FA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_001E4005
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E494A GetFileAttributesW,FindFirstFileW,FindClose, 16_2_001E494A
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_001EC2FF
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ECD14 FindFirstFileW,FindClose, 16_2_001ECD14
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001ECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 16_2_001ECD9F
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_001EF5D8
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 16_2_001EF735
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001EFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 16_2_001EFA36
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001E3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 16_2_001E3CE2
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009E5D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 11_2_009E5D13
Source: ApolloSphere.pif, 00000010.00000002.3255848857.0000000003A92000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM\
Source: Flash.pif, 0000000B.00000002.3255647611.0000000001325000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process information queried: ProcessInformation Jump to behavior
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A445D5 BlockInput, 11_2_00A445D5
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009E5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 11_2_009E5240
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A05CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 11_2_00A05CAC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_004062FC
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A288CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 11_2_00A288CD
Enables debug privileges
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_009FA385
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009FA354 SetUnhandledExceptionFilter, 11_2_009FA354
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001AA354 SetUnhandledExceptionFilter, 16_2_001AA354
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001AA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_001AA385
Contains functionality to execute programs as a different user
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A29369 LogonUserW, 11_2_00A29369
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009E5240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 11_2_009E5240
Contains functionality to simulate keystroke presses
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A31AC6 SendInput,keybd_event, 11_2_00A31AC6
Contains functionality to simulate mouse events
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A351E2 mouse_event, 11_2_00A351E2
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Surgeons Surgeons.cmd & Surgeons.cmd & exit Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\tasklist.exe tasklist Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 723582 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "wagemissileaffiliatesgreeting" Fisting Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Restriction + Manager + Screw + Anchor 723582\r Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\723582\Flash.pif 723582\Flash.pif 723582\r Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 15 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Process created: C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe C:\Users\user\AppData\Local\Temp\723582\RegAsm.exe Jump to behavior
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif "C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif" "C:\Users\user\AppData\Local\EduTech Dynamics\L" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A288CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 11_2_00A288CD
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A34F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 11_2_00A34F1C
Source: f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe, 00000000.00000003.2011358694.0000000002835000.00000004.00000020.00020000.00000000.sdmp, Flash.pif, 0000000B.00000002.3254407214.0000000000A86000.00000002.00000001.01000000.00000005.sdmp, Flash.pif, 0000000B.00000003.2078132463.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Flash.pif, ApolloSphere.pif Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_009F885B cpuid 11_2_009F885B
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A10030 GetLocalTime,__swprintf, 11_2_00A10030
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A10722 GetUserNameW, 11_2_00A10722
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A0416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 11_2_00A0416A
Source: C:\Users\user\Desktop\f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_00406805
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Flash.pif PID: 4368, type: MEMORYSTR
OS version to string mapping found (often used in BOTs)
Source: ApolloSphere.pif Binary or memory string: WIN_81
Source: ApolloSphere.pif Binary or memory string: WIN_XP
Source: ApolloSphere.pif Binary or memory string: WIN_XPe
Source: ApolloSphere.pif Binary or memory string: WIN_VISTA
Source: ApolloSphere.pif Binary or memory string: WIN_7
Source: ApolloSphere.pif Binary or memory string: WIN_8
Source: Flash.pif.2.dr Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 4USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0000000B.00000002.3256409691.000000000141A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3256254115.0000000001350000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3249041675.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3249083801.000000000139B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.3256579902.00000000014CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248898877.0000000001351000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248832355.00000000042DB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248740085.000000000141B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.3248696366.00000000030D4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Flash.pif PID: 4368, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A4696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 11_2_00A4696E
Source: C:\Users\user\AppData\Local\Temp\723582\Flash.pif Code function: 11_2_00A46E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 11_2_00A46E32
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001F696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 16_2_001F696E
Source: C:\Users\user\AppData\Local\EduTech Dynamics\ApolloSphere.pif Code function: 16_2_001F6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 16_2_001F6E32
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483220 Sample: f3ba41ba0b508b0965153c1688d... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 48 RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP 2->48 52 Found malware configuration 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Yara detected RedLine Stealer 2->56 58 7 other signatures 2->58 10 f3ba41ba0b508b0965153c1688d6df6de6b3fdf59b015.exe 38 2->10         started        14 wscript.exe 1 2->14         started        signatures3 process4 file5 46 C:\Users\user\AppData\Local\Temp\Wallpapers, PDP-11 10->46 dropped 64 Found stalling execution ending in API Sleep call 10->64 16 cmd.exe 3 10->16         started        66 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->66 20 ApolloSphere.pif 14->20         started        signatures6 process7 file8 38 C:\Users\user\AppData\Local\...\Flash.pif, PE32 16->38 dropped 50 Drops PE files with a suspicious file extension 16->50 22 Flash.pif 5 16->22         started        26 cmd.exe 2 16->26         started        28 conhost.exe 16->28         started        30 7 other processes 16->30 signatures9 process10 file11 40 C:\Users\user\AppData\...\ApolloSphere.pif, PE32 22->40 dropped 42 C:\Users\user\AppData\...\ApolloSphere.js, ASCII 22->42 dropped 44 C:\Users\user\AppData\Local\...\RegAsm.exe, PE32 22->44 dropped 60 Drops PE files with a suspicious file extension 22->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 22->62 32 schtasks.exe 1 22->32         started        34 RegAsm.exe 22->34         started        signatures12 process13 process14 36 conhost.exe 32->36         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
RADgSUbEiddPOZAFcUYmDkmxSjP.RADgSUbEiddPOZAFcUYmDkmxSjP unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
88.99.151.68:7200 true
  • Avira URL Cloud: safe
 unknown