Windows Analysis Report
systemms.exe

Overview

General Information

Sample name: systemms.exe
Analysis ID: 1542815
MD5: b9a90c673713f61195b6e695d5f57ba4
SHA1: 17831341f6b113bb3da1ffe536c1861c96839180
SHA256: 1b55754dc53235978759ae3474e144a3e3ebd0b43d5cd1a722372408bf982b51
Tags: exeuser-karneth
Infos:

Detection

Quasar
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Quasar RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Quasar RAT, QuasarRAT Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
 https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: systemms.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Avira: detection malicious, Label: HEUR/AGEN.1305769
Found malware configuration
Source: systemms.exe Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "192.168.18.54:8000;", "SubDirectory": "Systemms", "InstallName": "systemms.exe", "MutexName": "00b3e629-d348-4f5c-a497-f354aac050f8", "StartupKey": "Systemmso", "LogDirectoryName": "Logs", "ServerSignature": "lydGi97hjDEjhULrVgVS5PErE4hDdgcrGn/U6DKJsKi2zm9/n5YkYMgCeTt5WRY8NpyQ3FQPxj6+R6sDetd4DHguGmNCg9hKhhC0JVqKGkCvv1Mw5AAtT0fvJRGVIW+NzcicQ8ExEnvtDALqzV0ik/NDDriud2+lRSfrq+Ygx9xxxVmIuHtAY81FmipQJuQ9frb9F7e9oWRm4YN2Pzt6XlPhxSU+LGGuIzCzj4zzrDwYWyD884K7WOLanCwW5cx6RiiFyy2QVU8Z5VOLm9w3fmnfFt5xvCf10C81PXS/JT3Rp8yYGfR5O4lpi8wAeeF0XgnsdNgegqijzuqFHFroCWCEbbahoLv9uwQ38EAF2D8mXMIGWS63Tntt3VEIbJmY7Y8tFnTsSSWH9/AlFB+wuW6bemwSp1MYHXtr/ovwbyMVfXd1d9oO+U8Su4nPQ4qHcFL9CxIfPf7c7vnj7Lg5xstFwd9hPAUsHuhytccwSGgfgkUooboWMrDeavmDh7fFJtHryj1hzrOjhhiOQKxVl8DcB5FZ556lWzHSSdglqfhvLOe9uije38//eWrw7yWtrJR+0IEzGIJC0BDeEg1CKLbvlS9Zz9AIUdEAPX1oyJ9hq2IIIpYUWI6oq+0M0emzI4sS1NL/yA4iWSsgT1yAQAioFDdvntHe2rtmQOcZcGo=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQALrax6pl3CEXcf0kZ8NqjzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMTEwNjE3MjExOFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArSZJpGvG9E0L7vtsIYaJJdxEVhsTXJbbq2hSOsXz/5z5S4H/FYs5NNm+2iIpvXtgYFnk9xWU8+ZNh1M0l2cFR4MqBaAiMyq8JVzqQDjZXGwanVnhRGZ/yKJq3tvwpPzQAK424SboykTvcT2B7OyXOfWl4yUZjtoMqWmiGf5GhXsM+a9gjubvVdDSK0hkJxrUmbHo4Lz001w2B5qj35PFCCUTvxu/modgXH3VNkyEBeQVZKdllA83Dz3EM1kCo+0PLwQePSQSAi81dTpGHD2+f5KHZ9fu2kHoxh81o5Mwqhqtpf6k8Lp+cY7TUF2o8gmRy8tTPxZbiCFzumwnuRMq/4C+B5w6R82c1SpDpM+6IaHYyqcTgcLL275uqFD8ENjSzuhwUrH4yJguGn0Der+5uULPPaX2Q51202CdBMmaB7jH/j8b1gGrZJlC1SFyBfYDavueK0pi/FepKwe75Kt1LzC8dld75fYlDqM/uacoiSqiXMGX25iWlEdX0GdMRF21EXMh0vp7LUnn5/TWPCM5+w4QIXTd5ENgkA/jOwY1uJM1qvLI0fwH0aLEMbP2Rv/4BIR7KrZKuiHL0qOve/Yej5nxULIT3C42DXMDArxDVLugiK0riFVqHssd+aaPoISwGs+82xurdpnQBYzWTVbDvCzDNAvCYngdYuOpmKiYZsUCAwEAAaMyMDAwHQYDVR0OBBYEFOu/tkCJVZOTVuZTFOoG4IqAV9WQMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAGbeA3758oIIfuGiaGaHylty7Ea/1FW69Mu+9BFbltGA7HEbHHtYNtE9TxDEr+ZZPkfbdZjNz7YGqyhLyAPJPidv92DpejZW7BKvYJrL+qWSB6WaJlAPgVJoI4xFtleH0PmoRYmRcrOM0AHnx+kPxxLdu7gigKzum3XhU8Ry/K8eGqzqPiCgrsgcOuQIxGqNwOkJqcuiuIA0MGd8VUtzuhNNHTHwAUXMPRZO0cfdlatYt1wr/9ApXH/VbDncSlybItnuDMIOeNcO05sqYsNQZNl2bUFB65zmSvbiAJdWKPiNjH7tBRVW3/F5bSd6D8QCr25xGl5RHSD1S9ZQJrIed8o0mHr88uupJKwafr/GNCsEz8VMt9wmZoq3tsSKA1qik6xAYN+OIggquqQyXFKrhkxYB9tswEMnGKNJMjJTlvIKpXBIfFoDNmoCNZstPTFWKW+sQKKmXitX0QbIvTkRprcvVs0ER5dyRfydxgtX5r7rxo0Wm4vl8TlHjhBGrXCnErQAJ6yt+joHLeV7GO2MtcDqoxa2vyR3cY5lEOSRCLdHcVeVIPKppbo8gbhPWlX4frdt6LNmPSFQFgHUQPuPk3hURuTFILLALL1gmZAbsrcbbS3fDn/2to4fDTdZiZNth82YMuaiVJ32cERr7rxHv0RaIcWF3rdqFsWdQmq2yddH"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe ReversingLabs: Detection: 68%
Multi AV Scanner detection for submitted file
Source: systemms.exe ReversingLabs: Detection: 68%
Yara detected Quasar RAT
Source: Yara match File source: systemms.exe, type: SAMPLE
Source: Yara match File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: systemms.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: systemms.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: systemms.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 192.168.18.54
Yara detected Generic Downloader
Source: Yara match File source: systemms.exe, type: SAMPLE
Source: Yara match File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED
Source: systemms.exe, 00000000.00000002.1698107509.0000000003571000.00000004.00000800.00020000.00000000.sdmp, systemms.exe, 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: systemms.exe, systemms.exe.0.dr String found in binary or memory: https://api.ipify.org/
Source: systemms.exe, systemms.exe.0.dr String found in binary or memory: https://ipwho.is/
Source: systemms.exe, systemms.exe.0.dr String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: systemms.exe, systemms.exe.0.dr String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: systemms.exe, systemms.exe.0.dr String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Systemms\systemms.exe Jump to behavior

E-Banking Fraud
barindex
Yara detected Quasar RAT
Source: Yara match File source: systemms.exe, type: SAMPLE
Source: Yara match File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: systemms.exe, type: SAMPLE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: systemms.exe, type: SAMPLE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: systemms.exe, type: SAMPLE Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: Detects Quasar infostealer Author: ditekshen
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB1AAAD 3_2_00007FFD9BB1AAAD
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB19AC4 3_2_00007FFD9BB19AC4
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB16243 3_2_00007FFD9BB16243
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB16187 3_2_00007FFD9BB16187
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB18D41 3_2_00007FFD9BB18D41
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB154B6 3_2_00007FFD9BB154B6
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB111FA 3_2_00007FFD9BB111FA
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB10DD1 3_2_00007FFD9BB10DD1
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB110F2 3_2_00007FFD9BB110F2
Sample file is different than original file name gathered from version info
Source: systemms.exe, 00000000.00000000.1675052364.0000000001210000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe
Source: systemms.exe Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe
Source: systemms.exe.0.dr Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe
Uses 32bit PE files
Source: systemms.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: systemms.exe, type: SAMPLE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: systemms.exe, type: SAMPLE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: systemms.exe, type: SAMPLE Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@10/2@0/1
Source: C:\Users\user\Desktop\systemms.exe File created: C:\Users\user\AppData\Roaming\Systemms Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\00b3e629-d348-4f5c-a497-f354aac050f8
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
Source: systemms.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: systemms.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\systemms.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: systemms.exe ReversingLabs: Detection: 68%
Source: systemms.exe String found in binary or memory: HasSubValue3Conflicting item/add type
Source: C:\Users\user\Desktop\systemms.exe File read: C:\Users\user\Desktop\systemms.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\systemms.exe "C:\Users\user\Desktop\systemms.exe"
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe"
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe C:\Users\user\AppData\Roaming\Systemms\systemms.exe
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Section loaded: msasn1.dll Jump to behavior
Source: systemms.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: systemms.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: systemms.exe Static file information: File size 3333120 > 1048576
Source: systemms.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c400
Source: systemms.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9B8AD9F2 push eax; iretd 3_2_00007FFD9B8ADA11
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9B8A752B push ebx; iretd 3_2_00007FFD9B8A756A
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB154B6 push ecx; retf 3_2_00007FFD9BB159DC
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB12F90 push eax; ret 3_2_00007FFD9BB12FFC
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Code function: 3_2_00007FFD9BB15948 push ecx; retf 3_2_00007FFD9BB159DC
Drops PE files
Source: C:\Users\user\Desktop\systemms.exe File created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\systemms.exe File opened: C:\Users\user\Desktop\systemms.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe File opened: C:\Users\user\AppData\Roaming\Systemms\systemms.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe File opened: C:\Users\user\AppData\Roaming\Systemms\systemms.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\systemms.exe Memory allocated: 1850000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Memory allocated: 1B570000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Memory allocated: EA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Memory allocated: 1A8F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Memory allocated: 11B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Memory allocated: 1AD10000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Window / User API: threadDelayed 2743 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Window / User API: threadDelayed 7092 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\systemms.exe TID: 6456 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6856 Thread sleep time: -25825441703193356s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6932 Thread sleep count: 2743 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6932 Thread sleep count: 7092 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 5820 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: systemms.exe, 00000003.00000002.4144827859.000000001B450000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Enables debug privileges
Source: C:\Users\user\Desktop\systemms.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\systemms.exe Queries volume information: C:\Users\user\Desktop\systemms.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Queries volume information: C:\Users\user\AppData\Roaming\Systemms\systemms.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe Queries volume information: C:\Users\user\AppData\Roaming\Systemms\systemms.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Quasar RAT
Source: Yara match File source: systemms.exe, type: SAMPLE
Source: Yara match File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected Quasar RAT
Source: Yara match File source: systemms.exe, type: SAMPLE
Source: Yara match File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1542815 Sample: systemms.exe Startdate: 26/10/2024 Architecture: WINDOWS Score: 100 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 Antivirus / Scanner detection for submitted sample 2->36 38 6 other signatures 2->38 8 systemms.exe 5 2->8         started        12 systemms.exe 2 2->12         started        process3 file4 26 C:\Users\user\AppData\...\systemms.exe, PE32 8->26 dropped 28 C:\Users\user\AppData\...\systemms.exe.log, CSV 8->28 dropped 40 Uses schtasks.exe or at.exe to add and modify task schedules 8->40 42 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->42 14 systemms.exe 2 8->14         started        18 schtasks.exe 1 8->18         started        signatures5 process6 dnsIp7 30 192.168.18.54, 49730, 49731, 49738 unknown unknown 14->30 44 Antivirus detection for dropped file 14->44 46 Multi AV Scanner detection for dropped file 14->46 48 Machine Learning detection for dropped file 14->48 50 2 other signatures 14->50 20 schtasks.exe 1 14->20         started        22 conhost.exe 18->22         started        signatures8 process9 process10 24 conhost.exe 20->24         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private

IP
192.168.18.54

Contacted URLs

Name Malicious Antivirus Detection Reputation
192.168.18.54 true
    		unknown