Windows Analysis Report
systemms.exe

AI detected suspicious sample

Source: Yara match	File source: systemms.exe, type: SAMPLE
Source: Yara match	File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: systemms.exe

Joe Sandbox ML: detected

Source: systemms.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: systemms.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 192.168.18.54

Yara detected Generic Downloader

Source: Yara match	File source: systemms.exe, type: SAMPLE
Source: Yara match	File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

Source: systemms.exe, 00000000.00000002.1698107509.0000000003571000.00000004.00000800.00020000.00000000.sdmp, systemms.exe, 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: systemms.exe, systemms.exe.0.dr	String found in binary or memory: https://api.ipify.org/
Source: systemms.exe, systemms.exe.0.dr	String found in binary or memory: https://ipwho.is/
Source: systemms.exe, systemms.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: systemms.exe, systemms.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: systemms.exe, systemms.exe.0.dr	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\Systemms\systemms.exe

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: systemms.exe, type: SAMPLE
Source: Yara match	File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

System Summary

Source: systemms.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: systemms.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: systemms.exe, type: SAMPLE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: Detects Quasar infostealer Author: ditekshen

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB1AAAD	3_2_00007FFD9BB1AAAD
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB19AC4	3_2_00007FFD9BB19AC4
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB16243	3_2_00007FFD9BB16243
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB16187	3_2_00007FFD9BB16187
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB18D41	3_2_00007FFD9BB18D41
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB154B6	3_2_00007FFD9BB154B6
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB111FA	3_2_00007FFD9BB111FA
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB10DD1	3_2_00007FFD9BB10DD1
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB110F2	3_2_00007FFD9BB110F2

Source: systemms.exe, 00000000.00000000.1675052364.0000000001210000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe
Source: systemms.exe	Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe
Source: systemms.exe.0.dr	Binary or memory string: OriginalFilenameSystemmso4 vs systemms.exe

Source: systemms.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: systemms.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: systemms.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: systemms.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/2@0/1

Source: C:\Users\user\Desktop\systemms.exe

File created: C:\Users\user\AppData\Roaming\Systemms

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\00b3e629-d348-4f5c-a497-f354aac050f8
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03

Source: systemms.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: systemms.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\systemms.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: systemms.exe

ReversingLabs: Detection: 68%

Source: systemms.exe

String found in binary or memory: HasSubValue3Conflicting item/add type

Source: C:\Users\user\Desktop\systemms.exe

File read: C:\Users\user\Desktop\systemms.exe

Uses schtasks.exe or at.exe to add and modify task schedules

Source: unknown	Process created: C:\Users\user\Desktop\systemms.exe "C:\Users\user\Desktop\systemms.exe"
Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe"
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe C:\Users\user\AppData\Roaming\Systemms\systemms.exe
Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Section loaded: msasn1.dll	Jump to behavior

Source: systemms.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: systemms.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: systemms.exe

Static file information: File size 3333120 > 1048576

Source: systemms.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c400

Source: systemms.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9B8AD9F2 push eax; iretd	3_2_00007FFD9B8ADA11
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9B8A752B push ebx; iretd	3_2_00007FFD9B8A756A
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB154B6 push ecx; retf	3_2_00007FFD9BB159DC
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB12F90 push eax; ret	3_2_00007FFD9BB12FFC
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Code function: 3_2_00007FFD9BB15948 push ecx; retf	3_2_00007FFD9BB159DC

Source: C:\Users\user\Desktop\systemms.exe

File created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe

Jump to dropped file

Boot Survival

Source: C:\Users\user\Desktop\systemms.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\systemms.exe	File opened: C:\Users\user\Desktop\systemms.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	File opened: C:\Users\user\AppData\Roaming\Systemms\systemms.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	File opened: C:\Users\user\AppData\Roaming\Systemms\systemms.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe	Memory allocated: 1850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Memory allocated: 1B570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Memory allocated: 1A8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Memory allocated: 11B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Memory allocated: 1AD10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Window / User API: threadDelayed 2743			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Window / User API: threadDelayed 7092			Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe TID: 6456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6856	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6932	Thread sleep count: 2743 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 6932	Thread sleep count: 7092 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe TID: 5820	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: systemms.exe, 00000003.00000002.4144827859.000000001B450000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\systemms.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\systemms.exe	Process created: C:\Users\user\AppData\Roaming\Systemms\systemms.exe "C:\Users\user\AppData\Roaming\Systemms\systemms.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe	Queries volume information: C:\Users\user\Desktop\systemms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Queries volume information: C:\Users\user\AppData\Roaming\Systemms\systemms.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe	Queries volume information: C:\Users\user\AppData\Roaming\Systemms\systemms.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\systemms.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: systemms.exe, type: SAMPLE
Source: Yara match	File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: systemms.exe, type: SAMPLE
Source: Yara match	File source: 0.0.systemms.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 6180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: systemms.exe PID: 3612, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	11 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
systemms.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
systemms.exe	100%	Avira	HEUR/AGEN.1305769
systemms.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Systemms\systemms.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\Systemms\systemms.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Systemms\systemms.exe	68%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
192.168.18.54	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	systemms.exe, systemms.exe.0.dr	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/14436606/23354	systemms.exe, systemms.exe.0.dr	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354sCannot	systemms.exe, systemms.exe.0.dr	false		unknown
https://ipwho.is/	systemms.exe, systemms.exe.0.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	systemms.exe, 00000000.00000002.1698107509.0000000003571000.00000004.00000800.00020000.00000000.sdmp, systemms.exe, 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/11564914/23354;	systemms.exe, systemms.exe.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.18.54

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542815
Start date and time:	2024-10-26 14:02:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	systemms.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@10/2@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 99% Number of executed functions: 29 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target systemms.exe, PID 6160 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: systemms.exe

Simulations

Behavior and APIs

Time	Type	Description
08:03:01	API Interceptor	15700331x Sleep call for process: systemms.exe modified
13:03:00	Task Scheduler	Run new task: Systemmso path: C:\Users\user\AppData\Roaming\Systemms\systemms.exe

Process:	C:\Users\user\Desktop\systemms.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Roaming\Systemms\systemms.exe

Download File

Process:	C:\Users\user\Desktop\systemms.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3333120
Entropy (8bit):	6.0967781653239665
Encrypted:	false
SSDEEP:	49152:0vht62XlaSFNWPjljiFa2RoUYIZKt86oGdSTHHB72eh2NT:0vL62XlaSFNWPjljiFXRoUYIZKtJ
MD5:	B9A90C673713F61195B6E695D5F57BA4
SHA1:	17831341F6B113BB3DA1FFE536C1861C96839180
SHA-256:	1B55754DC53235978759AE3474E144A3E3EBD0B43D5CD1A722372408BF982B51
SHA-512:	9A4A6EEA5604F08B71367EBFB59CEB05CC518D545F869360082817DE9B86625975E81751A25ADBA2E4B7FAF2DA95D0F98BC79E95180060A66E9677257C3CA78C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: ditekshen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@3...........@.................................p.1.K.....2.`.................... 3...................................................... ............... ..H............text.....1.. ....1................. ..`.rsrc...`.....2.......1.............@..@.reloc....... 3.......2.............@..B..................1.....H...........`............k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.0967781653239665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	systemms.exe
File size:	3'333'120 bytes
MD5:	b9a90c673713f61195b6e695d5f57ba4
SHA1:	17831341f6b113bb3da1ffe536c1861c96839180
SHA256:	1b55754dc53235978759ae3474e144a3e3ebd0b43d5cd1a722372408bf982b51
SHA512:	9a4a6eea5604f08b71367ebfb59ceb05cc518d545f869360082817de9b86625975e81751a25adba2e4b7faf2da95d0f98bc79e95180060a66e9677257c3ca78c
SSDEEP:	49152:0vht62XlaSFNWPjljiFa2RoUYIZKt86oGdSTHHB72eh2NT:0vL62XlaSFNWPjljiFXRoUYIZKtJ
TLSH:	D6F55A2437F85E33E16AD6B395B1501663F1FC6AB363EB0B2181777E1C63B4188426A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@3...........@................................

File Icon


Icon Hash:	7171696d697151a1

Static PE Info

General

Entrypoint:	0x71e3be
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x640DFAE7 [Sun Mar 12 16:16:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x31e370	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x320000	0x11360	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x332000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x31c3c4	0x31c400	ddd31b2ceeb4e2434ee637620d8e0fa6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x320000	0x11360	0x11400	35af4eaf7a2f5f6779dfd470e3e13c7d	False	0.12119282155797101	data	4.862148946463795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x332000	0xc	0x200	4d500f037eed75b56776bd5a41faef15	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x320130	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.1068703418904531
RT_GROUP_ICON	0x330958	0x14	data	1.15
RT_VERSION	0x33096c	0x31c	data	0.3969849246231156
RT_MANIFEST	0x330c88	0x6d7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text	0.40319817247287265

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 14:03:01.855597019 CEST	49730	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:01.861054897 CEST	8000	49730	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:01.861238956 CEST	49730	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:01.871604919 CEST	49730	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:01.876880884 CEST	8000	49730	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:10.355956078 CEST	8000	49730	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:10.356050968 CEST	49730	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:10.367814064 CEST	49730	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:10.373574972 CEST	8000	49730	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:13.744982958 CEST	49731	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:13.751009941 CEST	8000	49731	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:13.751074076 CEST	49731	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:13.751409054 CEST	49731	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:13.757356882 CEST	8000	49731	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:22.229399920 CEST	8000	49731	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:22.230930090 CEST	49731	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:22.237982988 CEST	49731	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:22.243556976 CEST	8000	49731	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:25.542023897 CEST	49738	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:25.548746109 CEST	8000	49738	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:25.548969030 CEST	49738	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:25.549099922 CEST	49738	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:25.555289030 CEST	8000	49738	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:34.036586046 CEST	8000	49738	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:34.036683083 CEST	49738	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:34.037108898 CEST	49738	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:34.044183969 CEST	8000	49738	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:37.338749886 CEST	49739	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:37.347038031 CEST	8000	49739	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:37.347146988 CEST	49739	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:37.347419024 CEST	49739	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:37.353399992 CEST	8000	49739	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:45.831398964 CEST	8000	49739	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:45.831510067 CEST	49739	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:45.831912994 CEST	49739	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:45.837635040 CEST	8000	49739	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:49.182478905 CEST	49740	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:49.659852982 CEST	8000	49740	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:49.659953117 CEST	49740	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:49.660275936 CEST	49740	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:49.665860891 CEST	8000	49740	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:58.142056942 CEST	8000	49740	192.168.18.54	192.168.2.4
Oct 26, 2024 14:03:58.143961906 CEST	49740	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:58.144272089 CEST	49740	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:03:58.149691105 CEST	8000	49740	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:01.760512114 CEST	49768	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:01.766354084 CEST	8000	49768	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:01.766446114 CEST	49768	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:01.766715050 CEST	49768	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:01.772244930 CEST	8000	49768	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:10.261950970 CEST	8000	49768	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:10.262993097 CEST	49768	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:10.263268948 CEST	49768	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:10.268899918 CEST	8000	49768	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:13.823029995 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:13.828551054 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:13.828638077 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:13.828847885 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:13.834851980 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:23.125905991 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:23.125978947 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:23.126332045 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:23.126401901 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:23.126487970 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:23.126564980 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:23.126612902 CEST	49834	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:23.132057905 CEST	8000	49834	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:26.669749975 CEST	49900	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:26.675501108 CEST	8000	49900	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:26.677333117 CEST	49900	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:26.677333117 CEST	49900	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:26.682836056 CEST	8000	49900	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:35.174269915 CEST	8000	49900	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:35.174315929 CEST	49900	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:35.174647093 CEST	49900	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:35.180483103 CEST	8000	49900	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:38.905231953 CEST	49971	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:38.911072969 CEST	8000	49971	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:38.911154985 CEST	49971	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:38.911421061 CEST	49971	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:38.917011976 CEST	8000	49971	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:47.404344082 CEST	8000	49971	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:47.404422045 CEST	49971	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:47.404982090 CEST	49971	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:47.410408020 CEST	8000	49971	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:51.057785034 CEST	50011	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:51.064682007 CEST	8000	50011	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:51.064868927 CEST	50011	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:51.065288067 CEST	50011	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:51.071350098 CEST	8000	50011	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:59.547225952 CEST	8000	50011	192.168.18.54	192.168.2.4
Oct 26, 2024 14:04:59.547339916 CEST	50011	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:59.547799110 CEST	50011	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:04:59.555018902 CEST	8000	50011	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:02.979795933 CEST	50012	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:03.362219095 CEST	8000	50012	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:03.362330914 CEST	50012	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:03.362644911 CEST	50012	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:03.368303061 CEST	8000	50012	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:11.860133886 CEST	8000	50012	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:11.860224962 CEST	50012	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:11.860641956 CEST	50012	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:11.866170883 CEST	8000	50012	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:15.073333025 CEST	50013	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:15.079482079 CEST	8000	50013	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:15.079581022 CEST	50013	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:15.080179930 CEST	50013	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:15.085927010 CEST	8000	50013	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:23.563447952 CEST	8000	50013	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:23.563545942 CEST	50013	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:23.563813925 CEST	50013	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:23.569272041 CEST	8000	50013	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:26.635740042 CEST	50014	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:26.641647100 CEST	8000	50014	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:26.641805887 CEST	50014	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:26.642086983 CEST	50014	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:26.648088932 CEST	8000	50014	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:35.126408100 CEST	8000	50014	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:35.126523972 CEST	50014	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:35.127748966 CEST	50014	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:35.133634090 CEST	8000	50014	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:37.839165926 CEST	50015	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:37.845496893 CEST	8000	50015	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:37.845593929 CEST	50015	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:37.845921993 CEST	50015	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:37.851695061 CEST	8000	50015	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:46.328346014 CEST	8000	50015	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:46.328478098 CEST	50015	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:46.330471039 CEST	50015	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:46.336165905 CEST	8000	50015	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:48.657699108 CEST	50016	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:48.663743973 CEST	8000	50016	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:48.665148973 CEST	50016	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:48.672231913 CEST	50016	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:48.678199053 CEST	8000	50016	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:57.148437023 CEST	8000	50016	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:57.148508072 CEST	50016	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:57.149377108 CEST	50016	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:57.154915094 CEST	8000	50016	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:59.229943991 CEST	50017	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:59.236160040 CEST	8000	50017	192.168.18.54	192.168.2.4
Oct 26, 2024 14:05:59.236258030 CEST	50017	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:59.236742020 CEST	50017	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:05:59.243208885 CEST	8000	50017	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:07.718213081 CEST	8000	50017	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:07.718283892 CEST	50017	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:07.718642950 CEST	50017	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:07.724550009 CEST	8000	50017	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:09.464087009 CEST	50018	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:09.470347881 CEST	8000	50018	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:09.470417976 CEST	50018	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:09.470822096 CEST	50018	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:09.476692915 CEST	8000	50018	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:17.953303099 CEST	8000	50018	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:17.953511000 CEST	50018	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:17.953912020 CEST	50018	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:17.959304094 CEST	8000	50018	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:19.557853937 CEST	50019	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:19.563544035 CEST	8000	50019	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:19.563616037 CEST	50019	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:19.564011097 CEST	50019	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:19.569562912 CEST	8000	50019	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:28.043874979 CEST	8000	50019	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:28.043963909 CEST	50019	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:28.044373035 CEST	50019	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:28.051841974 CEST	8000	50019	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:29.417352915 CEST	50020	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:29.424801111 CEST	8000	50020	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:29.424880981 CEST	50020	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:29.425199032 CEST	50020	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:29.432344913 CEST	8000	50020	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:37.909770012 CEST	8000	50020	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:37.909838915 CEST	50020	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:37.910276890 CEST	50020	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:37.915638924 CEST	8000	50020	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:39.136156082 CEST	50021	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:39.141860008 CEST	8000	50021	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:39.141937017 CEST	50021	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:39.142261028 CEST	50021	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:39.148060083 CEST	8000	50021	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:47.642157078 CEST	8000	50021	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:47.642245054 CEST	50021	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:47.642693996 CEST	50021	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:47.648855925 CEST	8000	50021	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:48.714514971 CEST	50022	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:48.720273972 CEST	8000	50022	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:48.720380068 CEST	50022	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:48.720705032 CEST	50022	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:48.726330042 CEST	8000	50022	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:57.214648008 CEST	8000	50022	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:57.214723110 CEST	50022	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:57.215112925 CEST	50022	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:57.220588923 CEST	8000	50022	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:58.167337894 CEST	50023	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:58.173125029 CEST	8000	50023	192.168.18.54	192.168.2.4
Oct 26, 2024 14:06:58.173213005 CEST	50023	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:58.177470922 CEST	50023	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:06:58.182934046 CEST	8000	50023	192.168.18.54	192.168.2.4
Oct 26, 2024 14:07:06.651947021 CEST	8000	50023	192.168.18.54	192.168.2.4
Oct 26, 2024 14:07:06.652338982 CEST	50023	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:07:06.652596951 CEST	50023	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:07:06.658057928 CEST	8000	50023	192.168.18.54	192.168.2.4
Oct 26, 2024 14:07:09.948460102 CEST	50024	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:07:09.954278946 CEST	8000	50024	192.168.18.54	192.168.2.4
Oct 26, 2024 14:07:09.954369068 CEST	50024	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:07:09.954591990 CEST	50024	8000	192.168.2.4	192.168.18.54
Oct 26, 2024 14:07:09.959924936 CEST	8000	50024	192.168.18.54	192.168.2.4

Target ID:	0
Start time:	08:02:57
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\systemms.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\systemms.exe"
Imagebase:	0xee0000
File size:	3'333'120 bytes
MD5 hash:	B9A90C673713F61195B6E695D5F57BA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1674697555.0000000000EE2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Target ID:	1
Start time:	08:02:59
Start date:	26/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	08:02:59
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:02:59
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Roaming\Systemms\systemms.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Systemms\systemms.exe"
Imagebase:	0x440000
File size:	3'333'120 bytes
MD5 hash:	B9A90C673713F61195B6E695D5F57BA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000003.00000002.4137316139.0000000002929000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarStealer, Description: Detects Quasar infostealer, Source: C:\Users\user\AppData\Roaming\Systemms\systemms.exe, Author: ditekshen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	4
Start time:	08:03:00
Start date:	26/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks" /create /tn "Systemmso" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\Systemms\systemms.exe" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	08:03:00
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	08:03:00
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Roaming\Systemms\systemms.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Systemms\systemms.exe
Imagebase:	0x750000
File size:	3'333'120 bytes
MD5 hash:	B9A90C673713F61195B6E695D5F57BA4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true