Edit tour

Windows Analysis Report
ABA NEW ORDER No.2400228341.pdf.exe

Overview

General Information

Sample name:	ABA NEW ORDER No.2400228341.pdf.exe
Analysis ID:	1488523
MD5:	d9d0ba1c1cc0dd9243f36fba8b1147ad
SHA1:	eae15f17ee26ede826b934733e16762cd61c89fa
SHA256:	37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58
Tags:	exe
Infos:

Detection

AsyncRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Sigma detected: Suspicious Double Extension File Execution

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected UAC Bypass using CMSTP

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files with benign system names

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Conhost Spawned By Uncommon Parent Process

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ABA NEW ORDER No.2400228341.pdf.exe (PID: 2624 cmdline: "C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe" MD5: D9D0BA1C1CC0DD9243F36FBA8B1147AD)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegSvcs.exe (PID: 1632 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

CasPol.exe (PID: 5580 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe" MD5: 914F728C04D3EDDD5FBA59420E74E56B)

InstallUtil.exe (PID: 1776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 6768 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2860 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 5624 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 4852 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

svchost.exe (PID: 3792 cmdline: "C:\Users\user\AppData\Local\Temp\svchost.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

conhost.exe (PID: 2656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 3716 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 5592 cmdline: C:\Windows\system32\WerFault.exe -u -p 2624 -s 1048 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Malware Configuration

Threatname: AsyncRAT

{"Server": "twart.myfirewall.org", "Port": "14143", "Version": "0.5.8", "MutexName": "FEjYSsXzhpZixwA", "Autorun": "true", "Group": "null"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa0e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x274c6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1da87:$x1: AsyncRAT 0x1dac5:$x1: AsyncRAT 0x20094:$s6: VirtualBox 0x1ffac:$s8: Win32_ComputerSystem 0x2475a:$s8: Win32_ComputerSystem
00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000005.00000002.2303187820.0000000001666000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x3973b:$x1: AsyncRAT 0x39779:$x1: AsyncRAT 0x2bda6:$s8: Win32_ComputerSystem
00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x93947:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9f7af:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x94d30:$a2: Stub.exe 0x94dc0:$a2: Stub.exe 0xa0b98:$a2: Stub.exe 0xa0c28:$a2: Stub.exe 0x9050d:$a3: get_ActivatePong 0x9c375:$a3: get_ActivatePong 0x93b5f:$a4: vmware 0x9f9c7:$a4: vmware 0x939d7:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9f83f:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x912d8:$a6: get_SslClient 0x9d140:$a6: get_SslClient
00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x939d9:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x9f841:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x3222c:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: InstallUtil.exe PID: 1776	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: InstallUtil.exe PID: 1776	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 1776	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x7cc6:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x33061:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Process Memory Space: InstallUtil.exe PID: 1776	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6a27:$x1: AsyncRAT 0x6a59:$x1: AsyncRAT 0x3894b:$x1: AsyncRAT 0x3897d:$x1: AsyncRAT 0x6ece:$s6: VirtualBox 0x33127:$s6: VirtualBox 0x6e7d:$s8: Win32_ComputerSystem 0x7a35:$s8: Win32_ComputerSystem 0x29958:$s8: Win32_ComputerSystem 0x29d45:$s8: Win32_ComputerSystem 0x330da:$s8: Win32_ComputerSystem 0x36a0f:$s8: Win32_ComputerSystem 0x3b94b:$s8: Win32_ComputerSystem 0x3b960:$s8: Win32_ComputerSystem 0x3b9cf:$s8: Win32_ComputerSystem 0x3c341:$s8: Win32_ComputerSystem 0x3d809:$s8: Win32_ComputerSystem 0x3f95c:$s8: Win32_ComputerSystem
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x844f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x5015:$a3: get_ActivatePong 0x8667:$a4: vmware 0x84df:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5de0:$a6: get_SslClient
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x84e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x844f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9838:$a2: Stub.exe 0x98c8:$a2: Stub.exe 0x5015:$a3: get_ActivatePong 0x8667:$a4: vmware 0x84df:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x5de0:$a6: get_SslClient
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x84e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa24f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6e15:$a3: get_ActivatePong 0xa467:$a4: vmware 0xa2df:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7be0:$a6: get_SslClient
5.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa24f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x160b7:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x174a0:$a2: Stub.exe 0x17530:$a2: Stub.exe 0x6e15:$a3: get_ActivatePong 0x12c7d:$a3: get_ActivatePong 0xa467:$a4: vmware 0x162cf:$a4: vmware 0xa2df:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x16147:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7be0:$a6: get_SslClient 0x13a48:$a6: get_SslClient
0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x16149:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0xa24f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0xb638:$a2: Stub.exe 0xb6c8:$a2: Stub.exe 0x6e15:$a3: get_ActivatePong 0xa467:$a4: vmware 0xa2df:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x7be0:$a6: get_SslClient
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0xa2e1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack	Windows_Trojan_Asyncrat_11a11ba1	unknown	unknown	0x8fb2f:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x9b997:$a1: /c schtasks /create /f /sc onlogon /rl highest /tn " 0x90f18:$a2: Stub.exe 0x90fa8:$a2: Stub.exe 0x9cd80:$a2: Stub.exe 0x9ce10:$a2: Stub.exe 0x8c6f5:$a3: get_ActivatePong 0x9855d:$a3: get_ActivatePong 0x8fd47:$a4: vmware 0x9bbaf:$a4: vmware 0x8fbbf:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x9ba27:$a5: \nuR\noisreVtnerruC\swodniW\tfosorciM\erawtfoS 0x8d4c0:$a6: get_SslClient 0x99328:$a6: get_SslClient
0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse	Detects file containing reversed ASEP Autorun registry keys	ditekSHen	0x8fbc1:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM 0x9ba29:$s1: nuR\noisreVtnerruC\swodniW\tfosorciM
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe", CommandLine: "C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe", CommandLine|base64offset|contains: 4E, Image: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe, NewProcessName: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe, OriginalFileName: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 7088, ProcessCommandLine: "C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe", ProcessId: 2624, ProcessName: ABA NEW ORDER No.2400228341.pdf.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ProcessId: 1776, TargetFilename: C:\Users\user\AppData\Local\Temp\svchost.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ParentProcessId: 1776, ParentProcessName: InstallUtil.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, ProcessId: 6768, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5624, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ProcessId: 3792, ProcessName: svchost.exe

Sigma detected: Conhost Spawned By Uncommon Parent Process

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, CommandLine|base64offset|contains: }}, Image: C:\Windows\System32\conhost.exe, NewProcessName: C:\Windows\System32\conhost.exe, OriginalFileName: C:\Windows\System32\conhost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentProcessId: 3792, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ProcessId: 2656, ProcessName: conhost.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' , CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' , CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6768, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' , ProcessId: 2860, ProcessName: schtasks.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5624, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\svchost.exe" , ProcessId: 3792, ProcessName: svchost.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe, ParentProcessId: 1776, ParentProcessName: InstallUtil.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit, ProcessId: 6768, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": "twart.myfirewall.org", "Port": "14143", "Version": "0.5.8", "MutexName": "FEjYSsXzhpZixwA", "Autorun": "true", "Group": "null"}

Multi AV Scanner detection for domain / URL

Source: twart.myfirewall.org

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for submitted file

Source: ABA NEW ORDER No.2400228341.pdf.exe	ReversingLabs: Detection: 18%
Source: ABA NEW ORDER No.2400228341.pdf.exe	Virustotal: Detection: 25%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ABA NEW ORDER No.2400228341.pdf.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Jump to behavior

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdbP source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000005.00000002.2304002312.000000000325B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.5.dr
Source:	Binary string: System.Core.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000005.00000002.2304002312.000000000325B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.5.dr
Source:	Binary string: System.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER2D3D.tmp.dmp.9.dr

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: twart.myfirewall.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE

Source: InstallUtil.exe, 00000005.00000002.2304002312.0000000003255000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.2303187820.0000000001666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 Author: unknown
Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large array initializations

Source: ABA NEW ORDER No.2400228341.pdf.exe, -----.cs

Large array initialization: _0619_FDE0_0654_0656_06E2: array initializer size 4608

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: ABA NEW ORDER No.2400228341.pdf.exe
Source: initial sample	Static PE information: Filename: ABA NEW ORDER No.2400228341.pdf.exe

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F264B9	0_2_00007FF848F264B9
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F1DB40	0_2_00007FF848F1DB40
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F26BA5	0_2_00007FF848F26BA5
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F143D0	0_2_00007FF848F143D0
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F20D45	0_2_00007FF848F20D45
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F1A810	0_2_00007FF848F1A810
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F1A818	0_2_00007FF848F1A818
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F1DFB1	0_2_00007FF848F1DFB1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F225FA	0_2_00007FF848F225FA
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF849000001	0_2_00007FF849000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02F75B20	5_2_02F75B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02F74088	5_2_02F74088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02F74958	5_2_02F74958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_02F73D40	5_2_02F73D40

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2624 -s 1048

Source: ABA NEW ORDER No.2400228341.pdf.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ABA NEW ORDER No.2400228341.pdf.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: No import functions for PE file found

Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2219404304.000002626E330000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePetpack.dll0 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000000.2015700618.000002626DFE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePetpack.dll0 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000000.2015700618.000002626DFE2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameApimocubevelatohL vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2219433346.000002626E340000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOgiredehesuyawavoyedo8 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePetpack.dll0 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameStub.exe" vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2216590655.0000026210007000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePetpack.dll0 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2216590655.0000026210007000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameApimocubevelatohL vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe	Binary or memory string: OriginalFilenamePetpack.dll0 vs ABA NEW ORDER No.2400228341.pdf.exe
Source: ABA NEW ORDER No.2400228341.pdf.exe	Binary or memory string: OriginalFilenameApimocubevelatohL vs ABA NEW ORDER No.2400228341.pdf.exe

Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.2303187820.0000000001666000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Asyncrat_11a11ba1 reference_sample = fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Asyncrat, fingerprint = 715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8, id = 11a11ba1-c178-4415-9c09-45030b500f50, last_modified = 2021-10-04
Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, CMVDdCMCUbyx.cs	Base64 encoded string: 'Qoww5ehFnHCJ5b7A+UZQsvQ47AdQbtRuXqR/lW4b5gbJQsLpIKsu3K7019LNzEdVQDJceYvEKk79OQcBGAZIvE5VWvpDjVRbk0jPDlmr3FA=', 'iWDclf+jW1EQsvzvjfPnQDdHDGeF6baWvUQ2U81Qh/HNpbwgUSuobuIUbRUShxQmWmfgEhNF1Iqiauk89bItKA==', 'wRNW4BETj+bwxT6q0eUKO1zwzzanSDMtM7iZNvBLtJ1T8be7wU1xu+OwqRS0iMsDw/+lQ/b6jifeofaUo9HTPw==', 'YQApe99/C+WPlYA2BUeoH0BDJ1b9bs9UMXwUycN4cmAMcX3ZAysq94Go+BvEAxi3t/7CjfZcohsyun5Tf/yaRg==', 'qfM22YovPnL56LzPrmhZAvveyQALT5TY46IOxMj4HeccMt56EyJ+HTWrtnAfhzYsG83YDuvJ+98tSG9rFH41G2o8eQggSIMrHNQhTUsPOpWWOYXPCu3xWmBWPZhnTmZI7P2ZMe6FOmAM4nXOFM1vCyvlggGMNW1qQq5eFUW+0RuqRD04Uc8BdysPF4pPXSog5k2p5zfNNB54ict/ZNXtPebYCXPtbsWteG3c44vup0kDPb+1C/IBq8I5q5YAiY3IWXjj386PqUlKdjD7wTVLI7of2Mpz8PLhnUD/RVaGJ6Z73ABaXF0OhHkN7Eq2Nnoqt3jUVL+7BPOjCpycWYjf9tDn7SPMQiR2pvFOghWNdQW6KV98jyLFRrQ1DFonLCM48wpBto8Jp4s+8KYsc/jAhgoeQot3NPaB8rfeSS7hCCDm+jZ0C+ltQYiasqXJET8vJFNkK9dLOk342jcd7vCkMVHd1KxfiadBDhWpolhNbE0CsGoW4lzfX0HdWQW/t7+HsXjse/kBiBhyHo6u6EcxNhxhoCOGb0PU9s0HIM+BwrKg2kIj0c5bM3smjUw78VM2vVdWFWKyk0cuaJbyPooT5PWYRz3JFsbzvDpTMuYO0/SSqf/nVvtf06y0IgBcTb1QhT9l10zCa7vfY2boup2kD/UpNfuTkW5XRhVP0Yh0qUPfeCzkhkgBHbhf1hqrXeEPpqPvzkCd8QoMyffRf6ho4LfIC1AiuSz1KUrGNKjYKTVIXRJ4hz3GViPk8t4f/ToFT94vV9BUFPOrBYPHsBOjYGgCzptnunadBHENo806TqRcm+wLtzAuKCm7KVdDryupvCrW1IgWXLVCDJWXmV0oqO6hEzcvEieJp7sXUOdnfqLm05v+c9gqeddSeqkFJOMitzcq7z6Ggy/VGpn6ACvWgUX3S7mMAsAZs5HJ9AD766vrYHqO3OaEfo7HAJ6e0hlqjk0N6jfi+4y54RBC6T8nQOC4hse1N2GaYuQBH4LYVDFJ5eUCqe+uFqrIrhJgGgUHYqQQBB1/T9mDzw9+QyDaPlA1+K9F6sd5Z8igryjvxS2ho5nJUMUjg5D1yvHw980EhJ2dnFHdDdwR9oXa769Z3YwkMwSaqnKdhqh37NJV9j2XHI7SF75DRyOnd+3mAnguBXbaETfNsBmKtUW65g7gxNucrwG6zozBcTRT1cs+lmqXajYgUlbEbCVvUatFR+Zeood1+6s3rxAl8xV+hMMLSloKK13RI+KKjC+j5CY1S7joqpdkx8BjfP0pbkYpSo823Tojus6jRYJn1Wo+4KBHqkco2nuMyMJvvs7LG2DJ+RGzh/LLTg25xP4FN7yEOHB/9y8WpAFq+Wz41vNWjhf5HewoNMBaJ5Wnqj+dVtFK+IGjV3UnTkp9r8WFeiHnXgd2BHaVZOD2lnFrl7CnFe2V8maRtpDMvJ2zGb1mCFzkh9iSDyZKS9wilTZyBHjRPcdCWB0GmNnYEc4Y7VPvZx+iQcnU+AYxPPZWBwQU8/EwbmLvZooeupgoFNoi1Z/Z2xPo8+zzIR7dDreaQaDJHJw+39cOFCcq7XQZwSm7Lj11brr/Jq/VfRVeaa8UdZ4qrcdu9kS5Xq4oQ+F2wGb3M3itsxMrCxAZTdgLmwLhzYPuOy8PyDjPY5T3fwyvKF/WXSPLyb2dqPVS3Iczp7BVg7ze2ELRzc8b/GxFlquBIyTiQBW2pMqz6CfGPVJQ6SaQftoSrfV+b4DAIuNSmQHwWqe/HYuf1XuuXP7bDF/70smUQsnO1SJXWnvJxIs7bW51LHpnqMfCGUQxcJGU8Vm+lVYrAW+15QWMK1TlkVvdKO+Nv+ILxS79wga7vpC+763E1BGF5T3M8TkEJpslMQAPQwV+WniaHOyGK7cpwhvQylQau6f+YGdh7TAZn42Mwead5b5BSXc+m3voF97Wr2yAUIhViQUr4qUPvGUKni5b8Dhf0mKqAuoV8lqgi4i/9z+WbN38hSXhLJb7sWg5ZnQnSG117PXaKj3HLDjCLaprTJP16tvytJ34DC0/o/CE0s9LI0RVQ1ZKd07ra64QtZ7l1itilnh2MJmz1ing0LV091LM/lesgubX3kPl1nEtG8xGEigEZR0bmFDkBE541KtmgwOqayo+BdtK7qR8SyKEDtHQFbO/wt1dlK5yhHUFMXaaEio6QKDoVg1SaCIxDrSsl80aXhmZQ7VfkTKuEqmW/Bbrl3zr8qPKJFyXav3ZKt2z2RonFGiGp5pt2dpY7t/8xDccpAyl3mOUckl5LX56PcCCehmUhEfdOtfVFZ2jq9N1u8DrGZP0GymevRfJIzoGwKklJVgLAMD+YAGT2lJqVzpXJAk=', 'Hsc76wJbtI+q+10ZbKHYqlaRacBTOf3eCZw+UC/h3E+hRkDUydP8fkJKy9oAQlDA+avrYeAiEJUXqTpDLe9489IhsVg4aNJ9bfOnRuobWsU9fha2n5sRVS+6Un7wuYaEHglkQx49rQB5VnRAuoiUSehhPLF9BYLlxg/Y34t1o+9CDW2kU4zdMW2c5FYOOMWp3wBXyCG8nyCGbgInRuzSGGeOTaEiO2ugVD8j83goGdIrH/mw15/byRv1qNytcLLhT7d
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, CMVDdCMCUbyx.cs	Base64 encoded string: 'Qoww5ehFnHCJ5b7A+UZQsvQ47AdQbtRuXqR/lW4b5gbJQsLpIKsu3K7019LNzEdVQDJceYvEKk79OQcBGAZIvE5VWvpDjVRbk0jPDlmr3FA=', 'iWDclf+jW1EQsvzvjfPnQDdHDGeF6baWvUQ2U81Qh/HNpbwgUSuobuIUbRUShxQmWmfgEhNF1Iqiauk89bItKA==', 'wRNW4BETj+bwxT6q0eUKO1zwzzanSDMtM7iZNvBLtJ1T8be7wU1xu+OwqRS0iMsDw/+lQ/b6jifeofaUo9HTPw==', 'YQApe99/C+WPlYA2BUeoH0BDJ1b9bs9UMXwUycN4cmAMcX3ZAysq94Go+BvEAxi3t/7CjfZcohsyun5Tf/yaRg==', 'qfM22YovPnL56LzPrmhZAvveyQALT5TY46IOxMj4HeccMt56EyJ+HTWrtnAfhzYsG83YDuvJ+98tSG9rFH41G2o8eQggSIMrHNQhTUsPOpWWOYXPCu3xWmBWPZhnTmZI7P2ZMe6FOmAM4nXOFM1vCyvlggGMNW1qQq5eFUW+0RuqRD04Uc8BdysPF4pPXSog5k2p5zfNNB54ict/ZNXtPebYCXPtbsWteG3c44vup0kDPb+1C/IBq8I5q5YAiY3IWXjj386PqUlKdjD7wTVLI7of2Mpz8PLhnUD/RVaGJ6Z73ABaXF0OhHkN7Eq2Nnoqt3jUVL+7BPOjCpycWYjf9tDn7SPMQiR2pvFOghWNdQW6KV98jyLFRrQ1DFonLCM48wpBto8Jp4s+8KYsc/jAhgoeQot3NPaB8rfeSS7hCCDm+jZ0C+ltQYiasqXJET8vJFNkK9dLOk342jcd7vCkMVHd1KxfiadBDhWpolhNbE0CsGoW4lzfX0HdWQW/t7+HsXjse/kBiBhyHo6u6EcxNhxhoCOGb0PU9s0HIM+BwrKg2kIj0c5bM3smjUw78VM2vVdWFWKyk0cuaJbyPooT5PWYRz3JFsbzvDpTMuYO0/SSqf/nVvtf06y0IgBcTb1QhT9l10zCa7vfY2boup2kD/UpNfuTkW5XRhVP0Yh0qUPfeCzkhkgBHbhf1hqrXeEPpqPvzkCd8QoMyffRf6ho4LfIC1AiuSz1KUrGNKjYKTVIXRJ4hz3GViPk8t4f/ToFT94vV9BUFPOrBYPHsBOjYGgCzptnunadBHENo806TqRcm+wLtzAuKCm7KVdDryupvCrW1IgWXLVCDJWXmV0oqO6hEzcvEieJp7sXUOdnfqLm05v+c9gqeddSeqkFJOMitzcq7z6Ggy/VGpn6ACvWgUX3S7mMAsAZs5HJ9AD766vrYHqO3OaEfo7HAJ6e0hlqjk0N6jfi+4y54RBC6T8nQOC4hse1N2GaYuQBH4LYVDFJ5eUCqe+uFqrIrhJgGgUHYqQQBB1/T9mDzw9+QyDaPlA1+K9F6sd5Z8igryjvxS2ho5nJUMUjg5D1yvHw980EhJ2dnFHdDdwR9oXa769Z3YwkMwSaqnKdhqh37NJV9j2XHI7SF75DRyOnd+3mAnguBXbaETfNsBmKtUW65g7gxNucrwG6zozBcTRT1cs+lmqXajYgUlbEbCVvUatFR+Zeood1+6s3rxAl8xV+hMMLSloKK13RI+KKjC+j5CY1S7joqpdkx8BjfP0pbkYpSo823Tojus6jRYJn1Wo+4KBHqkco2nuMyMJvvs7LG2DJ+RGzh/LLTg25xP4FN7yEOHB/9y8WpAFq+Wz41vNWjhf5HewoNMBaJ5Wnqj+dVtFK+IGjV3UnTkp9r8WFeiHnXgd2BHaVZOD2lnFrl7CnFe2V8maRtpDMvJ2zGb1mCFzkh9iSDyZKS9wilTZyBHjRPcdCWB0GmNnYEc4Y7VPvZx+iQcnU+AYxPPZWBwQU8/EwbmLvZooeupgoFNoi1Z/Z2xPo8+zzIR7dDreaQaDJHJw+39cOFCcq7XQZwSm7Lj11brr/Jq/VfRVeaa8UdZ4qrcdu9kS5Xq4oQ+F2wGb3M3itsxMrCxAZTdgLmwLhzYPuOy8PyDjPY5T3fwyvKF/WXSPLyb2dqPVS3Iczp7BVg7ze2ELRzc8b/GxFlquBIyTiQBW2pMqz6CfGPVJQ6SaQftoSrfV+b4DAIuNSmQHwWqe/HYuf1XuuXP7bDF/70smUQsnO1SJXWnvJxIs7bW51LHpnqMfCGUQxcJGU8Vm+lVYrAW+15QWMK1TlkVvdKO+Nv+ILxS79wga7vpC+763E1BGF5T3M8TkEJpslMQAPQwV+WniaHOyGK7cpwhvQylQau6f+YGdh7TAZn42Mwead5b5BSXc+m3voF97Wr2yAUIhViQUr4qUPvGUKni5b8Dhf0mKqAuoV8lqgi4i/9z+WbN38hSXhLJb7sWg5ZnQnSG117PXaKj3HLDjCLaprTJP16tvytJ34DC0/o/CE0s9LI0RVQ1ZKd07ra64QtZ7l1itilnh2MJmz1ing0LV091LM/lesgubX3kPl1nEtG8xGEigEZR0bmFDkBE541KtmgwOqayo+BdtK7qR8SyKEDtHQFbO/wt1dlK5yhHUFMXaaEio6QKDoVg1SaCIxDrSsl80aXhmZQ7VfkTKuEqmW/Bbrl3zr8qPKJFyXav3ZKt2z2RonFGiGp5pt2dpY7t/8xDccpAyl3mOUckl5LX56PcCCehmUhEfdOtfVFZ2jq9N1u8DrGZP0GymevRfJIzoGwKklJVgLAMD+YAGT2lJqVzpXJAk=', 'Hsc76wJbtI+q+10ZbKHYqlaRacBTOf3eCZw+UC/h3E+hRkDUydP8fkJKy9oAQlDA+avrYeAiEJUXqTpDLe9489IhsVg4aNJ9bfOnRuobWsU9fha2n5sRVS+6Un7wuYaEHglkQx49rQB5VnRAuoiUSehhPLF9BYLlxg/Y34t1o+9CDW2kU4zdMW2c5FYOOMWp3wBXyCG8nyCGbgInRuzSGGeOTaEiO2ugVD8j83goGdIrH/mw15/byRv1qNytcLLhT7d

Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, CxYfMLCpccQVc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, CxYfMLCpccQVc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, CxYfMLCpccQVc.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, CxYfMLCpccQVc.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@25/10@0/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3792:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\FEjYSsXzhpZixwA
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2624
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6848:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\svchost.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat""

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ABA NEW ORDER No.2400228341.pdf.exe	ReversingLabs: Detection: 18%
Source: ABA NEW ORDER No.2400228341.pdf.exe	Virustotal: Detection: 25%

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

File read: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe "C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe"
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2624 -s 1048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static file information: File size 2180109 > 1048576

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: ABA NEW ORDER No.2400228341.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdbP source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdbRSDS source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000005.00000002.2304002312.000000000325B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.5.dr
Source:	Binary string: System.Core.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000005.00000002.2304002312.000000000325B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe.5.dr
Source:	Binary string: System.ni.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER2D3D.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WER2D3D.tmp.dmp.9.dr

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F15993 push eax; retf	0_2_00007FF848F159DD
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F1626D pushad ; ret	0_2_00007FF848F162C1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F162CF pushad ; ret	0_2_00007FF848F162C1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F154C9 pushfd ; iretd	0_2_00007FF848F154F1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F154F2 pushfd ; iretd	0_2_00007FF848F154F1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F17E48 push es; retf 0008h	0_2_00007FF848F17E49
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF848F100BD pushad ; iretd	0_2_00007FF848F100C1
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Code function: 0_2_00007FF849000001 push esp; retf 4810h	0_2_00007FF849000312

Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, PJxxidWPdtItzf.cs	High entropy of concatenated method names: 'DpMHvUMxVJA', 'vCYPnWiXqoEYkQld', 'TcHKEwwtCfwY', 'fAIUETxrRjiQInB', 'fWfQGaOpyp', 'xTPlyzgKUnl', 'lccPHAroiCKKOapDl', 'HFmPdJDmrWXMm', 'UhOkwbtZKorhvg', 'ikyLzamNftI'
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, PJxxidWPdtItzf.cs	High entropy of concatenated method names: 'DpMHvUMxVJA', 'vCYPnWiXqoEYkQld', 'TcHKEwwtCfwY', 'fAIUETxrRjiQInB', 'fWfQGaOpyp', 'xTPlyzgKUnl', 'lccPHAroiCKKOapDl', 'HFmPdJDmrWXMm', 'UhOkwbtZKorhvg', 'ikyLzamNftI'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\svchost.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Temp\svchost.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Jump to behavior

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"'

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp, ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory allocated: 2626E310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory allocated: 2626FD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 36F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 36F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Memory allocated: 56F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6336	Thread sleep count: 150 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 892	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe TID: 2676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: InstallUtil.exe, 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: ABA NEW ORDER No.2400228341.pdf.exe, 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 5_2_02F72D4C CheckRemoteDebuggerPresent,

5_2_02F72D4C

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ABA NEW ORDER No.2400228341.pdf.exe, ------------.cs	Reference to suspicious API methods: LoadLibrary(_FDD0_06DC_FD42_FBBF_FDCD_06ED_06E0_065D(_FD45._060A_FD4E_06D4))
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, Strept.cs	Reference to suspicious API methods: GetProcAddress(handle, methodName)
Source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, Strept.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)data.Length, 64u, out var lpflOldProtect)

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 40E000	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 10B5008	Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat""	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost.exe "C:\Users\user\AppData\Local\Temp\svchost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe	Queries volume information: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.2620008a6f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200096560.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ABA NEW ORDER No.2400228341.pdf.exe.26200004e18.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ABA NEW ORDER No.2400228341.pdf.exe PID: 2624, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1776, type: MEMORYSTR

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	2 Scheduled Task/Job	311 Process Injection	11 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Scheduled Task/Job	1 Scripting	2 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	51 Virtualization/Sandbox Evasion	Security Account Manager	51 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Obfuscated Files or Information	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
ABA NEW ORDER No.2400228341.pdf.exe	18%	ReversingLabs
ABA NEW ORDER No.2400228341.pdf.exe	25%	Virustotal	Browse
ABA NEW ORDER No.2400228341.pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\svchost.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\svchost.exe	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://upx.sf.net	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
twart.myfirewall.org	0%	Avira URL Cloud	safe
twart.myfirewall.org	10%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
twart.myfirewall.org	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000005.00000002.2304002312.0000000003255000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488523
Start date and time:	2024-08-06 07:30:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ABA NEW ORDER No.2400228341.pdf.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@25/10@0/0
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 86% Number of executed functions: 23 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 3792 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:31:15	API Interceptor	1x Sleep call for process: WerFault.exe modified
07:31:25	Task Scheduler	Run new task: svchost path: "C:\Users\user\AppData\Local\Temp\svchost.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\svchost.exe	09099627362726.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.10530.8108.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	719#U665a) HBL# LMSIN2407028 (by SEA) PO# 4500577338, by 1x40' HQ.pdf.scr.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	ISF - SO.4985 KEL-RIO GRANPE HBL#KELRIG2406221.scr.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	F46VBJ6Yvy.exe	Get hash	malicious	AgentTesla	Browse
	@#U570b#U5167DEBIT#U5e33#U55ae[#U4e2d#U6587#U672c#U5e63]-OI(K)_20240612161821.scr.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse
	order .exe	Get hash	malicious	AgentTesla	Browse
	06-07-2024 REVISED - BL#3330937P2454 SO#2003 #U63d0#U55ae#U96fb#U653e.scr.exe	Get hash	malicious	DarkTortilla, XWorm	Browse
	Mahsulot kodi va buyurtma miqdori.docx.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ABA NEW ORDER No_9031a34371ab8642e0937bc810cb66cbc1536861_c49a1ee0_fdbfad5a-00f2-4269-ab20-73ff51e13450\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.015225724391136
Encrypted:	false
SSDEEP:	192:cpwymgjF0UnUlaWBUUuzuiFiZ24lO8/1fik1:mw7gjmUnUlamU/zuiFiY4lO8/NH
MD5:	8BCD889E161D05141A91E28B2B1849E4
SHA1:	4D28444DDF6DA1500A03BEA132E1204DFA8F521B
SHA-256:	EEE8174142C442E44ADD143DDA2C57B492196698774645159C6F8FBE0B00463D
SHA-512:	C3445637A629E72FEB1341F1813AFB753E875EEA02D13E77C50EB6C558C353B3375065E407402CF87D70E5D68B6166E318E6C40BA4DBD95C954FBE3AA937BE57
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.7.3.9.5.8.6.0.4.6.4.2.3.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.7.3.9.5.8.6.0.9.1.7.3.4.8.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.b.f.a.d.5.a.-.0.0.f.2.-.4.2.6.9.-.a.b.2.0.-.7.3.f.f.5.1.e.1.3.4.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.c.7.d.2.8.0.-.7.f.d.5.-.4.9.a.0.-.a.e.0.4.-.3.3.a.4.3.8.8.e.9.d.d.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.A.B.A. .N.E.W. .O.R.D.E.R. .N.o...2.4.0.0.2.2.8.3.4.1...p.d.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.A.p.i.m.o.c.u.b.e.v.e.l.a.t.o.h.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.4.0.-.0.0.0.1.-.0.0.1.4.-.e.c.1.b.-.6.d.c.f.c.1.e.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.b.4.3.9.f.e.e.8.d.8.3.b.5.4.9.b.a.e.d.4.7.c.1.c.a.0.0.2.5.e.d.0.0.0.0.0.0.0.0.!.0.0.0.0.e.a.e.1.5.f.1.7.e.e.2.6.e.d.e.8.2.6.b.9.3.4.7.3.3.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D3D.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Aug 6 05:31:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	393795
Entropy (8bit):	3.2709449267920854
Encrypted:	false
SSDEEP:	3072:916RRQd4ii4ozcS95cIMG0rhlQ1CCqfs83+v0sH:912RlB95RqE83Q
MD5:	656594E50B293787BE65E296EEEFB1AB
SHA1:	E643EB929133E8B7263864F4A281FA0FE9DD1D1E
SHA-256:	46E609328567368130F8314D54529DBC0192291ADDD34DED20D868286ABBBA31
SHA-512:	F11978A57DF7452DD9C797342E92BBC361823A20E05E9E6720CD1B81A99185A1C1DBD67C2F7D98A0AF991D7DA55806CC623051A079F0A4580733E72A9D3D659A
Malicious:	false
Preview:	MDMP..a..... ..........f....................................$........................H..bu..........l.......8...........T...........()..............<8..........(:..............................................................................eJ.......:......Lw......................T.......@......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E28.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8694
Entropy (8bit):	3.718012647108099
Encrypted:	false
SSDEEP:	192:R6l7wVeJoAo6YEIaJv+1RGgmfU4tprQ89bPQAfElm:R6lXJHo6YEFJvTgmfU49P/fL
MD5:	56326FCF584ECF247879C44B39E49950
SHA1:	4FE5AE2D3FA8BE313CF958162705EC8E8695CAD2
SHA-256:	CE8F133971D294CD6B13C98C3053300879C6914F982EE72247398E8B3ACFD111
SHA-512:	8D8524E3B18B6F354B3834A49CA64417490B39906F49BC7676BF1FB625D762C1CC5ED95639B83C7079AD919145B0B6E5A78D81E07C2E02840AB9205F00B4B0D2
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.6.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E58.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4878
Entropy (8bit):	4.571224656195376
Encrypted:	false
SSDEEP:	48:cvIwWl8zs8Jg771I9MnWpW8VYN0Ym8M4JXv+Fj1yq85C2QM45zJPdd:uIjf6I7fW7VeJ017MizJPdd
MD5:	51F94D6BECEE944934DCA49713D77C8C
SHA1:	22A5F6AAD09C89A932659B4426CB7C423B714DBE
SHA-256:	2B0B3BFE6EEB1E03A59B9CADD9D524D768AC9392E5469A6EBEBBB36A609A2D93
SHA-512:	604210DD9005698CC08B4D9B16DBB66475A4A54E5DD241792ED98165CE6A78F18E167E5919DE7AB474B160790DC480A09F376D138A3ABDAC84A9094B99E272F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="443313" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	739
Entropy (8bit):	5.348505694476449
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhaWzAbDLI4MNldKZat92n4M6:ML9E4KlKDE4KhKiKhBsXE4qdK284j
MD5:	A65F13C4355387C4645D260206AE915F
SHA1:	F8857636BB3B50E634E96E7B0ECE6AD77656BA5F
SHA-256:	DB8CA2E253F03395ABECD812505666B3BD5CE699B798E3F624D22EE605FB290E
SHA-512:	0584E8911FD08CC0BB833C6373AE5D161D00CF40FB4533B5DD0D31F38CF1783BB25E34084995A2D116AFB01ABAD14005D62EE51A1D9B79E262EF28775B878AB6
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\svchost.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42064
Entropy (8bit):	6.19564898727408
Encrypted:	false
SSDEEP:	384:qtpFVLK0MsihB9VKS7xdgl6KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+RPZTg:GBMs2SqdSZ6Iq8BxTfqWR8h7ukP
MD5:	5D4073B2EB6D217C19F2B22F21BF8D57
SHA1:	F0209900FBF08D004B886A0B3BA33EA2B0BF9DA8
SHA-256:	AC1A3F21FCC88F9CEE7BF51581EAFBA24CC76C924F0821DEB2AFDF1080DDF3D3
SHA-512:	9AC94880684933BA3407CDC135ABC3047543436567AF14CD9269C4ADC5A6535DB7B867D6DE0D6238A21B94E69F9890DBB5739155871A624520623A7E56872159
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 09099627362726.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.10530.8108.exe, Detection: malicious, Browse Filename: 719#U665a) HBL# LMSIN2407028 (by SEA) PO# 4500577338, by 1x40' HQ.pdf.scr.exe, Detection: malicious, Browse Filename: ISF - SO.4985 KEL-RIO GRANPE HBL#KELRIG2406221.scr.exe, Detection: malicious, Browse Filename: F46VBJ6Yvy.exe, Detection: malicious, Browse Filename: @#U570b#U5167DEBIT#U5e33#U55ae[#U4e2d#U6587#U672c#U5e63]-OI(K)_20240612161821.scr.exe, Detection: malicious, Browse Filename: SPECIFICATIONS.exe, Detection: malicious, Browse Filename: order .exe, Detection: malicious, Browse Filename: 06-07-2024 REVISED - BL#3330937P2454 SO#2003 #U63d0#U55ae#U96fb#U653e.scr.exe, Detection: malicious, Browse Filename: Mahsulot kodi va buyurtma miqdori.docx.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,>.]..............0..T...........r... ........@.. ....................................`.................................4r..O....................b..PB...........p............................................... ............... ..H............text....R... ...T.................. ..`.rsrc................V..............@..@.reloc...............`..............@..B................hr......H........"..\|J..........lm.......o......................................2~.....o.....r...p(....VrK..p(....s...........0..........(....(....o....o....(....o.... .....T(....o....(....o....o ...o!....4(....o....(....o....o ...o".....(....rm..ps#...o....($........(%....o&....ry..p......%.r...p.%.(.....(....('....((.......o)...('........................."..(.....{Q...-...}Q.....(+...(....(,....(+..."..(-.....(......(.....r...p.(/...o0...s....}T...*....0.. .......~S...-.s

C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	156
Entropy (8bit):	4.984240966432295
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oUkh4E2J5xAIZXACSmqRDUkh4E2J5xAInTRI36lW1ZPy:hWKqTtT6923fSmq1923fT1lW1k
MD5:	F0CD3405A110290099B27D1CFA4A3B45
SHA1:	D76F9F4D7DAC779EC254163A99DA8FDBAB9BBEF6
SHA-256:	4EACA34DB68C55B7960BBD5FA99EA7E91D88CB7166CB779937897A1F62A348A4
SHA-512:	5AA1F3826123D6EEA65CF91976623C2BAE2DA1F0270DAF857ACADE4FE05C20DA84D8B3A17463A0CAC431CFAE8492BF0D4FA21565745D024954202BBC1BCEFEE4
Malicious:	true
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Local\Temp\svchost.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp89A5.tmp.bat" /f /q..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422172011487314
Encrypted:	false
SSDEEP:	6144:FSvfpi6ceLP/9skLmb0OT4WSPHaJG8nAgeMZMMhA2fX4WABlEnN90uhiTw:MvloT4W+EZMM6DFyr03w
MD5:	022FE55C33D5505294D4A96DC7EF1923
SHA1:	B50324596AFB08699F8932F30BCE852A8286CFAF
SHA-256:	E09648C9D892E688C9D111F3CF21462CC21667551177BC5BF06518DE514A36D5
SHA-512:	5F9F36634F747FDFAE1CE3809D60CBF2FEFBD070342B3B4C779AA4CFCAFEB9C114AC9F55430553CE4229A0E996AD67F2F580FBE4BF3455D168F7A64F3F6088BF
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm6.M.................................................................................................................................................................................................................................................................................................................................................Q7[.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	4.659840607039457
Encrypted:	false
SSDEEP:	48:zK4QsD4ql0+1AcJRy0EJP64gFljVlWo3ggxUnQK2qmBvgw1+5:zKgDEcTytNe3Wo3uQVBIe+5
MD5:	3BF802DEB390033F9A89736CBA5BFAFF
SHA1:	25A7177A92E0283B99C85538C4754A12AC8AD197
SHA-256:	5202EB464D6118AC60F72E89FBAAACF1FB8CF6A232F98F47F88D0E7B2F3AFDB3
SHA-512:	EB4F440D28ECD5834FD347F43D4828CA9FEE900FF003764DD1D18B95E0B84E414EAECF70D75236A1463366A189BC5CBA21613F79B5707BF7BDB3CEA312CCE4F7
Malicious:	false
Preview:	Microsoft (R) .NET Framework Installation utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....Usage: InstallUtil [/u \| /uninstall] [option [...]] assembly [[option [...]] assembly] [...]]....InstallUtil executes the installers in each given assembly...If the /u or /uninstall switch is specified, it uninstalls..the assemblies, otherwise it installs them. Unlike other..options, /u applies to all assemblies, regardless of where it..appears on the command line.....Installation is done in a transactioned way: If one of the..assemblies fails to install, the installations of all other..assemblies are rolled back. Uninstall is not transactioned.....Options take the form /switch=[value]. Any option that occurs..before the name of an assembly will apply to that assembly's..installation. Options are cumulative but overridable - options..specified for one assembly will apply to the next as well unless..the option is specified with a new value. The default for

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.438747761589633
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	ABA NEW ORDER No.2400228341.pdf.exe
File size:	2'180'109 bytes
MD5:	d9d0ba1c1cc0dd9243f36fba8b1147ad
SHA1:	eae15f17ee26ede826b934733e16762cd61c89fa
SHA256:	37f7dc1e5403ed4babd766ca88445f0c0fd555af19a5b669123660c262cc3f58
SHA512:	304503d20998426c25f8f12ff9907831e0184b5ac911a0ce45addec385cac82dc070a56ad8630b404a41023fb56140dda9498d8f1a659a77df2b944ebb6da6b9
SSDEEP:	6144:2TrjyPf1/pNLbtbTvspnI5p3YCmMuHrXOrfE8HiTAnnQUoJwS4LY5qhR:2TWBnjspnIb//XT7EAQPn4LJD
TLSH:	E3A557023A438E03FD5A5574C9E271F225FEAE637EF6A69FCF406D15382127D52128B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.........."...0.NS...2........... ....@...... ................................!...`................................

File Icon


Icon Hash:	4d9292f2c88cf60d

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B0F698 [Mon Aug 5 15:58:16 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x3072	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x72bc	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x534e	0x5400	a9f61c8ddcf80a6e5f29fb3e42049223	False	0.6067708333333334	data	6.049175821080101	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x3072	0x3200	a85859a4d0823dc173e5ec354048098a	False	0.145234375	data	3.39285849001111	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x815c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 11811 x 11811 px/m			0.10020746887966805
RT_GROUP_ICON	0xa704	0x14	data			1.15
RT_VERSION	0xa718	0x3b8	COM executable for DOS			0.4852941176470588
RT_VERSION	0xaad0	0x3b8	COM executable for DOS	English	United States	0.4810924369747899
RT_MANIFEST	0xae88	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	01:30:55
Start date:	06/08/2024
Path:	C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ABA NEW ORDER No.2400228341.pdf.exe"
Imagebase:	0x2626dfe0000
File size:	2'180'109 bytes
MD5 hash:	D9D0BA1C1CC0DD9243F36FBA8B1147AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2214558710.000002620042F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Asyncrat_11a11ba1, Description: unknown, Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000000.00000002.2214558710.0000026200001000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:30:55
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:30:59
Start date:	06/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
Imagebase:
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	01:30:59
Start date:	06/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:30:59
Start date:	06/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0xef0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.2302268303.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2304002312.0000000003111000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000005.00000002.2303187820.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:31:00
Start date:	06/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:31:00
Start date:	06/08/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2624 -s 1048
Imagebase:	0x7ff6dc980000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"' & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat""
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Local\Temp\svchost.exe"'
Imagebase:	0x6d0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:31:24
Start date:	06/08/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 3
Imagebase:	0xeb0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:31:27
Start date:	06/08/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\svchost.exe"
Imagebase:	0xfb0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:31:27
Start date:	06/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F143D0 Relevance: 3.2, Strings: 2, Instructions: 720
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF848F16C7F
XeH, xrefs: 00007FF848F16F50

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID: XeH$d
API String ID: 0-1699507218
Opcode ID: c824bc0e290cd1a86af79b1656fbd405f25af70be2505354c383510bcae7a1c2
Instruction ID: 5f2feff0871103126548823cdd725ceb2409ca2ed510908b35e93788562fba9c
Opcode Fuzzy Hash: c824bc0e290cd1a86af79b1656fbd405f25af70be2505354c383510bcae7a1c2
Instruction Fuzzy Hash: 2C221F31A1CA4A4FE749EB2898825B177E0FF55350F1442BAD48AC71D7EE2DAC42C785

Function 00007FF848F1A818 Relevance: 2.8, Strings: 1, Instructions: 1532COMMON

Download Yara Rule

Strings

N_, xrefs: 00007FF848F23494

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID: N_
API String ID: 0-2522080108
Opcode ID: 163078ae55a2f70bbe8d258bb339e7f50b2dfea194f9ea2d134685a75b14b293
Instruction ID: 1ec1959e2c4853ad23d4c9a753659421d2e27c137d9e6dffec5285df0b73b8b0
Opcode Fuzzy Hash: 163078ae55a2f70bbe8d258bb339e7f50b2dfea194f9ea2d134685a75b14b293
Instruction Fuzzy Hash: 3AB2D271A0DA4A8FE799EB2CE49567877E1FF55340F0401BAD04EC72E2DF29AC418B46

Function 00007FF849000001 Relevance: 2.2, Instructions: 2181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221040125.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83757748a6101b46d54979470eff66c9a84f39e6f29f423cb38288110926a112
Instruction ID: 6813ade1ba24fdb340076d1e24987da6e6da29810a7da7aecc01b5effbe4e603
Opcode Fuzzy Hash: 83757748a6101b46d54979470eff66c9a84f39e6f29f423cb38288110926a112
Instruction Fuzzy Hash: 93E20A7280D7C68FEB66EF28A8555A47FF0FF56344F1805FAC089CB193EA28A845C751

Function 00007FF848F20D45 Relevance: 2.0, Instructions: 2006COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c26a9aeaed559a2bee876915dd232d23294551baa5fc385f17bc1ad0f2419ea
Instruction ID: e43001c12a1d8f68dda406d0ecb513ba41b43a21f7873f4aa531820d1494250f
Opcode Fuzzy Hash: 8c26a9aeaed559a2bee876915dd232d23294551baa5fc385f17bc1ad0f2419ea
Instruction Fuzzy Hash: 59D26531A0CB854FE319EB2894914B5B7E2FF85340F1446BED48AC72D6DF29E886C785

Function 00007FF848F1DFB1 Relevance: 1.4, Instructions: 1442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38460aa30b4e0482fb6f3072d7fe155b9965c5312dfba92e98497015806d57b
Instruction ID: d364e2daf2044524b7742e7d3a95b02280a7c93d34d56850ea7a256ede3220e8
Opcode Fuzzy Hash: c38460aa30b4e0482fb6f3072d7fe155b9965c5312dfba92e98497015806d57b
Instruction Fuzzy Hash: C9A22530A1CB4A8FE349EB28C4945A5B7E1FF95345F1445BED08AC72E6DF39A846C780

Function 00007FF848F225FA Relevance: 1.1, Instructions: 1063COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b7db11b2b466624889fe4e63f4f1c2b68741319cf2756b40f61bfcdcb4bac8
Instruction ID: 830d6497a070ef50ed77eefe0f853219e1f769de4abf4b6b0b657c8251a8eca1
Opcode Fuzzy Hash: 09b7db11b2b466624889fe4e63f4f1c2b68741319cf2756b40f61bfcdcb4bac8
Instruction Fuzzy Hash: 4F72563191CB4A4FE359EB2894905B5B7E1FF94350F1006BED48AC72E6DF39A846C781

Function 00007FF848F1A810 Relevance: .9, Instructions: 928COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf4776f815391678e8f1e42f0cb228f7dcede60407701fb6657d769278dafad
Instruction ID: 43b4d5f880aee2490f2fa03abb7287b70069103e7480185038211f09e2a23045
Opcode Fuzzy Hash: bbf4776f815391678e8f1e42f0cb228f7dcede60407701fb6657d769278dafad
Instruction Fuzzy Hash: 6C52C530A1CA098FDB68EB28D855A7977E1FF59341F5401BEE44EC72D2DF28AC428785

Function 00007FF848F1DB40 Relevance: .5, Instructions: 490COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9bf9e0496b0b36370b7978abe2863932c9d4fe92a73be55f1ab7c1a06ed1a9
Instruction ID: 27dfab8843bf996493c4fc466c1162571cd5013a78095593d3da65ea803b3394
Opcode Fuzzy Hash: 9a9bf9e0496b0b36370b7978abe2863932c9d4fe92a73be55f1ab7c1a06ed1a9
Instruction Fuzzy Hash: 51E1353190CA964FE31DEB2884915B1B7E2FF91341F1446BED4CAC72E5DF29A846C781

Function 00007FF848F26BA5 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8328214996c8041b4e4cbb2e38a1b2373d6d5d42a81fb148bff8baac4f9458d4
Instruction ID: d39a071c480e3e88d1d5613a0391c02db175ab57bc0d24e430657b2254ac2e68
Opcode Fuzzy Hash: 8328214996c8041b4e4cbb2e38a1b2373d6d5d42a81fb148bff8baac4f9458d4
Instruction Fuzzy Hash: 67518C31A0D6490FE31DAB38AC561B57BE5EB82310F1482BFD48AC71D7DE29A84743C6

Function 00007FF848F264B9 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d542c07777d80ca1680be46ade742ef7d2fc35f275c468effba8866d387b60f
Instruction ID: 927dc4b44cd0b97ffecbd4dca82b90c1992eb73cf85289fad4ebae922680a58a
Opcode Fuzzy Hash: 9d542c07777d80ca1680be46ade742ef7d2fc35f275c468effba8866d387b60f
Instruction Fuzzy Hash: B351293260E3950FD31E96385C661A17FA1DB87220B1A82FFD086CF2E7D9285C07C395

Function 00007FF848F15381 Relevance: 1.6, APIs: 1, Instructions: 127
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848F1543D

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3f6721941c9b5a7907597d395587f72d5cb07071ddbe713b3e3d6782d4463d5b
Instruction ID: d9228b15919b45d2acd75700d29133be4543a4a14dfedcd2c25cb7e33f439a68
Opcode Fuzzy Hash: 3f6721941c9b5a7907597d395587f72d5cb07071ddbe713b3e3d6782d4463d5b
Instruction Fuzzy Hash: DC31163190D78C4FDB19EBA898156FD7BE1EB96321F04426FE089C3192CA7468068796

Function 00007FF848F10949 Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848F109DF

Memory Dump Source

Source File: 00000000.00000002.2220720696.00007FF848F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f10000_ABA NEW ORDER No.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: 4233f71a14015971af6083db0bdae0ff5577e22c422adeb3fb6b328a5efde055
Instruction ID: 73a438455825ac47e4f905d4669486f8dc5eefb002dbe5ea774eb51bfb2c9bac
Opcode Fuzzy Hash: 4233f71a14015971af6083db0bdae0ff5577e22c422adeb3fb6b328a5efde055
Instruction Fuzzy Hash: 4931087190C7588FDB19EF68D84AAFA7BF4EF56320F00426FE089C3552DB686846CB51

Function 00007FF8490010C9 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2221040125.00007FF849000000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF849000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff849000000_ABA NEW ORDER No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e20ab7120fcebdba5fcd81537a32f41a4d287d3c024c386f3cc302effea04ea
Instruction ID: 26f1379a6c88d6e5eb9e3aa508589ca4b7020fdd4bc615381b169cd9f4fe0053
Opcode Fuzzy Hash: 9e20ab7120fcebdba5fcd81537a32f41a4d287d3c024c386f3cc302effea04ea
Instruction Fuzzy Hash: 5841F83180CAC98FDF9AEF24E8559F47BA0FF66344B1501EAD049C7192EA24EC51C741

Analysis Process: InstallUtil.exePID: 1776, Parent PID: 2624COMMON

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	20%
Total number of Nodes:	15
Total number of Limit Nodes:	0

Executed Functions

Function 02F72D4C Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 02F7532F

Memory Dump Source

Source File: 00000005.00000002.2303829856.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f70000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e17b10cbf75159f913919839b5e11320ee17f2645bafef4e179712c5e1b3739b
Instruction ID: 2219c44857062282bad6b4721ee4d060001a4cb0052dc9d72933bb126a501b06
Opcode Fuzzy Hash: e17b10cbf75159f913919839b5e11320ee17f2645bafef4e179712c5e1b3739b
Instruction Fuzzy Hash: C02166B18002198FCB10CF9AC484BEEBBF4AF48320F14845AE918A7250D778A944CFA0

Function 02F752B0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNELBASE(00000000,?), ref: 02F7532F

Memory Dump Source

Source File: 00000005.00000002.2303829856.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f70000_InstallUtil.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 12e2a0111b276df53758b3171934a15b5b2fa5831fbfba8a77ca1f1c50be6e2a
Instruction ID: 963f59f6a136c19e6688b396a4dbe3c8f631079cfec9d776e79ff79c2ce2cb6c
Opcode Fuzzy Hash: 12e2a0111b276df53758b3171934a15b5b2fa5831fbfba8a77ca1f1c50be6e2a
Instruction Fuzzy Hash: 8B212AB1C002598FCB10CF9AD585BEEFBF5EF48310F24845AE959A7250D778A944CF61

Analysis Process: svchost.exePID: 3792, Parent PID: 5624COMMON

Executed Functions

Function 05C104EC Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

8wq, xrefs: 05C10851

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID: 8wq
API String ID: 0-1015343481
Opcode ID: 945e1045296b0c63b28845f025b0139a8cbc2d5c1e244fd490af1428b5673654
Instruction ID: 6bb07c37a967d15ed25ab5d3029fc1837a657b841caba17c7ae6e10ae18f10b0
Opcode Fuzzy Hash: 945e1045296b0c63b28845f025b0139a8cbc2d5c1e244fd490af1428b5673654
Instruction Fuzzy Hash: 96F065F1D01209DFCF04CBB8E951ADD77F5FB89310B2085AA8408EB251EA755E429B10

Function 05C10888 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

tPsq, xrefs: 05C10963

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID: tPsq
API String ID: 0-2327162360
Opcode ID: bdc20f776a3865adfb059bd26ffc529cbf62b589ec784cbff70e35f35cf0a5a9
Instruction ID: 671bfa303b1a4336312a5050b645b4ad7cb560edd59cfa0f2544ea45d536d8db
Opcode Fuzzy Hash: bdc20f776a3865adfb059bd26ffc529cbf62b589ec784cbff70e35f35cf0a5a9
Instruction Fuzzy Hash: C34129B57002118FCB48EB78C49892D7BF2FF8971176554A8E906CB372DE36DC429B80

Function 05C10898 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

tPsq, xrefs: 05C10963

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID: tPsq
API String ID: 0-2327162360
Opcode ID: 9d22692450d09d2c344379d332fe5b9211bd02da96304cdbf727bc0bc721fc09
Instruction ID: 74c6cff7861af3e55b419f8fbe3f8c6d73a7ed6eb7b3cc9adfe02057613fde58
Opcode Fuzzy Hash: 9d22692450d09d2c344379d332fe5b9211bd02da96304cdbf727bc0bc721fc09
Instruction Fuzzy Hash: C641E7B57002118FCB58EB78C49892D77F2FF8971176158A8E906DB372DE36DC429B80

Function 05C10A40 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

$sq, xrefs: 05C10A98

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID: $sq
API String ID: 0-923501781
Opcode ID: 87d2b07eec4693e46f1c78661d202be1549a7fa81cbde5417487e9b7e02a8ba0
Instruction ID: 6737291d5e86156af7fb80cfd3f6f49b5e76c06bebb026a0ecc58fbab4bbf984
Opcode Fuzzy Hash: 87d2b07eec4693e46f1c78661d202be1549a7fa81cbde5417487e9b7e02a8ba0
Instruction Fuzzy Hash: D22187327052118FDB14CA7CE888B7FB3E9FFC1610B14453AE40AE3240DA32C8829794

Function 05C10848 Relevance: 1.3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

Strings

8wq, xrefs: 05C10851

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID: 8wq
API String ID: 0-1015343481
Opcode ID: 9248c9d31647b5c49aed8eb3d94a0c505fe4f732bd742d5b200296d8ceef34a3
Instruction ID: 7364b44984bedc18e43424124d18e8ff58c4bfa569841261298217435a2fe072
Opcode Fuzzy Hash: 9248c9d31647b5c49aed8eb3d94a0c505fe4f732bd742d5b200296d8ceef34a3
Instruction Fuzzy Hash: 97E0E6B190410DEBCF04DBB9D95195DB7A9EB85200B1055A99408A7250EE316E009B55

Function 01B9D5F4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2335416146.0000000001B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1b9d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eddde2786c81b4e1c39f9dbb0d084b6db5d92d02444232a9dc44325d19eebeec
Instruction ID: b760a9203fbc4a3d684e45506a270871518052ea0008115f3e46c03143227f61
Opcode Fuzzy Hash: eddde2786c81b4e1c39f9dbb0d084b6db5d92d02444232a9dc44325d19eebeec
Instruction Fuzzy Hash: B52121B2504200DFCF09DF99D9C0B26BF65FB88314F2086A9E9090A256C336D416CAE1

Function 01B9D5EF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2335416146.0000000001B9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_1b9d000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 8beb6b63b6db18c9e30b3a64818d5e5772ba9b2d38148470df3bfe47d1c823aa
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 3111DC76404280CFCF16CF54D9C0B16BF72FB88324F2486A9E9090B656C33AD45ACBA2

Function 05C10A10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2336257055.0000000005C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_5c10000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4167af9e3e2e6859739d0d367a04615bb33a5be11e4de781a1ba0f80c3db8e
Instruction ID: 7d868a04f1b901511044ae04d0ba3c759938e6004f2f0e84b40a53f57d034adc
Opcode Fuzzy Hash: 8e4167af9e3e2e6859739d0d367a04615bb33a5be11e4de781a1ba0f80c3db8e
Instruction Fuzzy Hash: 74D0C775B451148FCA08EB78D44445CB761EFC537531006E5D539DB1B1DA31D811C715

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ABA NEW ORDER No.2400228341.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ABA NEW ORDER No_9031a34371ab8642e0937bc810cb66cbc1536861_c49a1ee0_fdbfad5a-00f2-4269-ab20-73ff51e13450\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D3D.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E28.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E58.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

C:\Users\user\AppData\Local\Temp\svchost.exe

C:\Users\user\AppData\Local\Temp\tmp89A5.tmp.bat

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

\Device\Null

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
ABA NEW ORDER No.2400228341.pdf.exe

Function 00007FF848F143D0 Relevance: 3.2, Strings: 2, Instructions: 720
COMMON

Function 00007FF848F1DFB1 Relevance: 1.4, Instructions: 1442
COMMON