Edit tour

Windows Analysis Report
intro.avi.exe

Overview

General Information

Sample name:	intro.avi.exe
Analysis ID:	1583245
MD5:	d219d94cabaa00e5abffc599bdeef75d
SHA1:	123e511de20beab7bfa2bea5c2206422bc5e8241
SHA256:	3cc847687e60acda504fc35577f36eedd0bca559a4de915d6dd88db9178567d4
Tags:	exeQuasarRATuser-lontze7
Infos:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Quasar RAT

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

intro.avi.exe (PID: 7560 cmdline: "C:\Users\user\Desktop\intro.avi.exe" MD5: D219D94CABAA00E5ABFFC599BDEEF75D)

schtasks.exe (PID: 7692 cmdline: "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systemware.exe (PID: 7740 cmdline: "C:\Users\user\AppData\Roaming\system\systemware.exe" MD5: D219D94CABAA00E5ABFFC599BDEEF75D)

schtasks.exe (PID: 7808 cmdline: "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7904 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7996 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)

PING.EXE (PID: 8040 cmdline: ping -n 10 localhost MD5: B3624DD758CCECF93A1226CEF252CA12)

systemware.exe (PID: 7312 cmdline: "C:\Users\user\AppData\Roaming\system\systemware.exe" MD5: D219D94CABAA00E5ABFFC599BDEEF75D)

WerFault.exe (PID: 8056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 2312 MD5: C31336C1EFC2CCB44B4326EA793040F2)

intro.avi.exe (PID: 7824 cmdline: C:\Users\user\Desktop\intro.avi.exe MD5: D219D94CABAA00E5ABFFC599BDEEF75D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Host:Port": "X&\\ @p)8I)-qX$", "InstallName": "/A: _2C<Q", "MutexName": "vc%\\uNjM", "StartupKey": "-<>.&r", "Tag": "MhIs>", "ServerSignature": "(\"Dy{{(/Q4", "ServerCertificate": "u?9:$PNPb"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
intro.avi.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
intro.avi.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
intro.avi.exe	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ec19:$a1: GetKeyloggerLogsResponse 0x3e37a:$a2: DoDownloadAndExecute 0x50800:$a3: http://api.ipify.org/ 0x4e309:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f657:$a5: " /sc ONLOGON /tr "
intro.avi.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3e136:$s1: DoUploadAndExecute 0x3e37a:$s2: DoDownloadAndExecute 0x3defb:$s3: DoShellExecute 0x3e332:$s4: set_Processname 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60 0x5948:$op2: 00 17 03 1F 20 17 19 15 28 0x63ae:$op3: 00 04 03 69 91 1B 40 0x6bfe:$op3: 00 04 03 69 91 1B 40
intro.avi.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3ec19:$x1: GetKeyloggerLogsResponse 0x3ee59:$s1: DoShellExecuteResponse 0x3e7c8:$s2: GetPasswordsResponse 0x3ed2c:$s3: GetStartupItemsResponse 0x3e14a:$s5: RunHidden 0x3e168:$s5: RunHidden 0x3e176:$s5: RunHidden 0x3e18a:$s5: RunHidden
intro.avi.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4f61d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x4f853:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
intro.avi.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3ec19:$x3: GetKeyloggerLogsResponse 0x3de71:$x4: GetKeyloggerLogs 0x3e149:$s1: <RunHidden>k__BackingField 0x3ede1:$s2: set_SystemInfos 0x3e172:$s3: set_RunHidden 0x3dca5:$s4: set_RemotePath 0x3202c:$s7: xClient.Core.ReverseProxy.Packets
intro.avi.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x305c0:$x4: xClient.Properties.Resources.resources 0x30481:$s4: Client.exe 0x3e172:$s7: set_RunHidden
intro.avi.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x51607:$x2: Process already elevated. 0x3a2e6:$x4: get_encryptedPassword 0x3e37a:$x5: DoDownloadAndExecute
intro.avi.exe	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x4f800:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f949:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f818:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f961:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f854:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f99d:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f88c:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x4f8d2:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x3defb:$: DoShellExecute 0x3ee59:$: DoShellExecute 0x3de43:$: DoDownloadFile 0x3de52:$: DoDownloadFile 0x3ea87:$: DoDownloadFile
intro.avi.exe	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4f016:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ec2a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33fd0:$class: Core.MouseKeyHook.WinApi
intro.avi.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x4eeda:$f1: FileZilla\recentservers.xml 0x4ef1a:$f2: FileZilla\sitemanager.xml 0x4ef4e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x4e4c5:$b1: Chrome\User Data\ 0x4e529:$b1: Chrome\User Data\ 0x4e8bc:$b2: Mozilla\Firefox\Profiles 0x4ec90:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x53500:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x4ed20:$b4: Opera Software\Opera Stable\Login Data 0x4edd0:$b5: YandexBrowser\User Data\ 0x4ee42:$b5: YandexBrowser\User Data\ 0x4e670:$s4: logins.json 0x4e6bc:$s4: logins.json 0x4e9aa:$s4: logins.json 0x4e1da:$a1: username_value 0x4e1f8:$a2: password_value 0x3a2be:$a3: encryptedUsername 0x3a2d4:$a3: encryptedUsername 0x3a40a:$a3: encryptedUsername 0x3a2ea:$a4: encryptedPassword 0x3a300:$a4: encryptedPassword
intro.avi.exe	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3ec19:$s1: GetKeyloggerLogsResponse 0x3de71:$s2: GetKeyloggerLogs 0x4daaa:$s3: />Log created on 0x4ec2a:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x4e309:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x51cda:$s6: grabber_ 0x51cf6:$s6: grabber_ 0x3302f:$s7: <virtualKeyCode> 0x3e149:$s8: <RunHidden>k__BackingField 0x33061:$s9: <keyboardHookStruct> 0x36416:$s10: add_OnHotKeysDown 0x36468:$s10: add_OnHotKeysDown 0x50668:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x50d25:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 8 entries

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\system\systemware.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Roaming\system\systemware.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\system\systemware.exe	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ec19:$a1: GetKeyloggerLogsResponse 0x3e37a:$a2: DoDownloadAndExecute 0x50800:$a3: http://api.ipify.org/ 0x4e309:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f657:$a5: " /sc ONLOGON /tr "
C:\Users\user\AppData\Roaming\system\systemware.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3e136:$s1: DoUploadAndExecute 0x3e37a:$s2: DoDownloadAndExecute 0x3defb:$s3: DoShellExecute 0x3e332:$s4: set_Processname 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60 0x5948:$op2: 00 17 03 1F 20 17 19 15 28 0x63ae:$op3: 00 04 03 69 91 1B 40 0x6bfe:$op3: 00 04 03 69 91 1B 40
C:\Users\user\AppData\Roaming\system\systemware.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3ec19:$x1: GetKeyloggerLogsResponse 0x3ee59:$s1: DoShellExecuteResponse 0x3e7c8:$s2: GetPasswordsResponse 0x3ed2c:$s3: GetStartupItemsResponse 0x3e14a:$s5: RunHidden 0x3e168:$s5: RunHidden 0x3e176:$s5: RunHidden 0x3e18a:$s5: RunHidden
C:\Users\user\AppData\Roaming\system\systemware.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4f61d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x4f853:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Roaming\system\systemware.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3ec19:$x3: GetKeyloggerLogsResponse 0x3de71:$x4: GetKeyloggerLogs 0x3e149:$s1: <RunHidden>k__BackingField 0x3ede1:$s2: set_SystemInfos 0x3e172:$s3: set_RunHidden 0x3dca5:$s4: set_RemotePath 0x3202c:$s7: xClient.Core.ReverseProxy.Packets
C:\Users\user\AppData\Roaming\system\systemware.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x305c0:$x4: xClient.Properties.Resources.resources 0x30481:$s4: Client.exe 0x3e172:$s7: set_RunHidden
C:\Users\user\AppData\Roaming\system\systemware.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x51607:$x2: Process already elevated. 0x3a2e6:$x4: get_encryptedPassword 0x3e37a:$x5: DoDownloadAndExecute
C:\Users\user\AppData\Roaming\system\systemware.exe	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x4f800:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f949:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f818:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f961:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f854:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f99d:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f88c:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x4f8d2:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x3defb:$: DoShellExecute 0x3ee59:$: DoShellExecute 0x3de43:$: DoDownloadFile 0x3de52:$: DoDownloadFile 0x3ea87:$: DoDownloadFile
C:\Users\user\AppData\Roaming\system\systemware.exe	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4f016:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ec2a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33fd0:$class: Core.MouseKeyHook.WinApi
C:\Users\user\AppData\Roaming\system\systemware.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x4eeda:$f1: FileZilla\recentservers.xml 0x4ef1a:$f2: FileZilla\sitemanager.xml 0x4ef4e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x4e4c5:$b1: Chrome\User Data\ 0x4e529:$b1: Chrome\User Data\ 0x4e8bc:$b2: Mozilla\Firefox\Profiles 0x4ec90:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x53500:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x4ed20:$b4: Opera Software\Opera Stable\Login Data 0x4edd0:$b5: YandexBrowser\User Data\ 0x4ee42:$b5: YandexBrowser\User Data\ 0x4e670:$s4: logins.json 0x4e6bc:$s4: logins.json 0x4e9aa:$s4: logins.json 0x4e1da:$a1: username_value 0x4e1f8:$a2: password_value 0x3a2be:$a3: encryptedUsername 0x3a2d4:$a3: encryptedUsername 0x3a40a:$a3: encryptedUsername 0x3a2ea:$a4: encryptedPassword 0x3a300:$a4: encryptedPassword
C:\Users\user\AppData\Roaming\system\systemware.exe	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3ec19:$s1: GetKeyloggerLogsResponse 0x3de71:$s2: GetKeyloggerLogs 0x4daaa:$s3: />Log created on 0x4ec2a:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x4e309:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x51cda:$s6: grabber_ 0x51cf6:$s6: grabber_ 0x3302f:$s7: <virtualKeyCode> 0x3e149:$s8: <RunHidden>k__BackingField 0x33061:$s9: <keyboardHookStruct> 0x36416:$s10: add_OnHotKeysDown 0x36468:$s10: add_OnHotKeysDown 0x50668:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x50d25:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ea19:$a1: GetKeyloggerLogsResponse 0x3e17a:$a2: DoDownloadAndExecute 0x50600:$a3: http://api.ipify.org/ 0x4e109:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f457:$a5: " /sc ONLOGON /tr "
00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3df36:$s1: DoUploadAndExecute 0x3e17a:$s2: DoDownloadAndExecute 0x3dcfb:$s3: DoShellExecute 0x3e132:$s4: set_Processname 0x5824:$op1: 04 1E FE 02 04 16 FE 01 60 0x5748:$op2: 00 17 03 1F 20 17 19 15 28 0x61ae:$op3: 00 04 03 69 91 1B 40 0x69fe:$op3: 00 04 03 69 91 1B 40
00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x4f600:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f749:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f618:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f761:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f654:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f79d:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f68c:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x4f6d2:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x3dcfb:$: DoShellExecute 0x3ec59:$: DoShellExecute 0x3dc43:$: DoDownloadFile 0x3dc52:$: DoDownloadFile 0x3e887:$: DoDownloadFile
00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4ee16:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ea2a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33dd0:$class: Core.MouseKeyHook.WinApi
Process Memory Space: intro.avi.exe PID: 7560	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.intro.avi.exe.5f0000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.intro.avi.exe.5f0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.intro.avi.exe.5f0000.0.unpack	Windows_Trojan_Quasarrat_e52df647	unknown	unknown	0x3ec19:$a1: GetKeyloggerLogsResponse 0x3e37a:$a2: DoDownloadAndExecute 0x50800:$a3: http://api.ipify.org/ 0x4e309:$a4: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x4f657:$a5: " /sc ONLOGON /tr "
0.0.intro.avi.exe.5f0000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3e136:$s1: DoUploadAndExecute 0x3e37a:$s2: DoDownloadAndExecute 0x3defb:$s3: DoShellExecute 0x3e332:$s4: set_Processname 0x5a24:$op1: 04 1E FE 02 04 16 FE 01 60 0x5948:$op2: 00 17 03 1F 20 17 19 15 28 0x63ae:$op3: 00 04 03 69 91 1B 40 0x6bfe:$op3: 00 04 03 69 91 1B 40
0.0.intro.avi.exe.5f0000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3ec19:$x1: GetKeyloggerLogsResponse 0x3ee59:$s1: DoShellExecuteResponse 0x3e7c8:$s2: GetPasswordsResponse 0x3ed2c:$s3: GetStartupItemsResponse 0x3e14a:$s5: RunHidden 0x3e168:$s5: RunHidden 0x3e176:$s5: RunHidden 0x3e18a:$s5: RunHidden
0.0.intro.avi.exe.5f0000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4f61d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00 74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00 ... 0x4f853:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
0.0.intro.avi.exe.5f0000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3ec19:$x3: GetKeyloggerLogsResponse 0x3de71:$x4: GetKeyloggerLogs 0x3e149:$s1: <RunHidden>k__BackingField 0x3ede1:$s2: set_SystemInfos 0x3e172:$s3: set_RunHidden 0x3dca5:$s4: set_RemotePath 0x3202c:$s7: xClient.Core.ReverseProxy.Packets
0.0.intro.avi.exe.5f0000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x305c0:$x4: xClient.Properties.Resources.resources 0x30481:$s4: Client.exe 0x3e172:$s7: set_RunHidden
0.0.intro.avi.exe.5f0000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x51607:$x2: Process already elevated. 0x3a2e6:$x4: get_encryptedPassword 0x3e37a:$x5: DoDownloadAndExecute
0.0.intro.avi.exe.5f0000.0.unpack	implant_win_quasarrat	Detect QuasarRAT (reted from samples 2023-03)	Sekoia.io	0x4f800:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f949:$: 63 00 68 00 63 00 70 00 20 00 36 00 35 00 30 00 30 00 31 00 0x4f818:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f961:$: 65 00 63 00 68 00 6F 00 20 00 44 00 4F 00 4E 00 54 00 20 00 43 00 4C 00 4F 00 53 00 45 00 20 00 54 00 48 00 49 00 53 00 20 00 57 00 49 00 4E 00 44 00 4F 00 57 00 21 00 0x4f854:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f99d:$: 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0x4f88c:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x4f8d2:$: 64 00 65 00 6C 00 20 00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66 00 20 00 22 00 0x3defb:$: DoShellExecute 0x3ee59:$: DoShellExecute 0x3de43:$: DoDownloadFile 0x3de52:$: DoDownloadFile 0x3ea87:$: DoDownloadFile
0.0.intro.avi.exe.5f0000.0.unpack	Quasar	detect Remcos in memory	JPCERT/CC Incident Response Group	0x4f016:$quasarstr1: [PRIVATE KEY LOCATION: "{0}"] 0x4ec2a:$quasarstr2: User: {0}{3}Pass: {1}{3}Host: {2} 0x33fd0:$class: Core.MouseKeyHook.WinApi
0.0.intro.avi.exe.5f0000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x4eeda:$f1: FileZilla\recentservers.xml 0x4ef1a:$f2: FileZilla\sitemanager.xml 0x4ef4e:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x4e4c5:$b1: Chrome\User Data\ 0x4e529:$b1: Chrome\User Data\ 0x4e8bc:$b2: Mozilla\Firefox\Profiles 0x4ec90:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x53500:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x4ed20:$b4: Opera Software\Opera Stable\Login Data 0x4edd0:$b5: YandexBrowser\User Data\ 0x4ee42:$b5: YandexBrowser\User Data\ 0x4e670:$s4: logins.json 0x4e6bc:$s4: logins.json 0x4e9aa:$s4: logins.json 0x4e1da:$a1: username_value 0x4e1f8:$a2: password_value 0x3a2be:$a3: encryptedUsername 0x3a2d4:$a3: encryptedUsername 0x3a40a:$a3: encryptedUsername 0x3a2ea:$a4: encryptedPassword 0x3a300:$a4: encryptedPassword
0.0.intro.avi.exe.5f0000.0.unpack	MALWARE_Win_QuasarRAT	QuasarRAT payload	ditekSHen	0x3ec19:$s1: GetKeyloggerLogsResponse 0x3de71:$s2: GetKeyloggerLogs 0x4daaa:$s3: />Log created on 0x4ec2a:$s4: User: {0}{3}Pass: {1}{3}Host: {2} 0x4e309:$s5: Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7} 0x51cda:$s6: grabber_ 0x51cf6:$s6: grabber_ 0x3302f:$s7: <virtualKeyCode> 0x3e149:$s8: <RunHidden>k__BackingField 0x33061:$s9: <keyboardHookStruct> 0x36416:$s10: add_OnHotKeysDown 0x36468:$s10: add_OnHotKeysDown 0x50668:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 0x50d25:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\system\systemware.exe", ParentImage: C:\Users\user\AppData\Roaming\system\systemware.exe, ParentProcessId: 7740, ParentProcessName: systemware.exe, ProcessCommandLine: "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f, ProcessId: 7808, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Suricata Signatures

ET MALWARE Common RAT Connectivity Check Observed

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T09:25:09.395784+0100	2036383	1	A Network Trojan was detected	192.168.2.9	49743	208.95.112.1	80	TCP
2025-01-02T09:25:11.739551+0100	2036383	1	A Network Trojan was detected	192.168.2.9	49754	208.95.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: intro.avi.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Avira: detection malicious, Label: HEUR/AGEN.1307418

Found malware configuration

Source: intro.avi.exe

Malware Configuration Extractor: Quasar {"Host:Port": "X&\\ @p)8I)-qX$", "InstallName": "/A: _2C<Q", "MutexName": "vc%\\uNjM", "StartupKey": "-<>.&r", "Tag": "MhIs>", "ServerSignature": "(\"Dy{{(/Q4", "ServerCertificate": "u?9:$PNPb"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

ReversingLabs: Detection: 84%

Multi AV Scanner detection for submitted file

Source: intro.avi.exe	Virustotal: Detection: 84%			Perma Link
Source: intro.avi.exe	ReversingLabs: Detection: 84%

Yara detected Quasar RAT

Source: Yara match	File source: intro.avi.exe, type: SAMPLE
Source: Yara match	File source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: intro.avi.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: intro.avi.exe

Joe Sandbox ML: detected

Source: intro.avi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: intro.avi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ServiceModel.Internals.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\system\systemware.PDB source: systemware.exe, 00000004.00000002.1615832564.000000000512F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: systemware.exe, 00000004.00000002.1615832564.000000000512F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\system\systemware.PDB source: systemware.exe, 00000004.00000002.1602361908.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: SMDiagnostics.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb~ source: systemware.exe, 00000004.00000002.1615832564.0000000005108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbSystem.Management.ni.dll source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdbAccessibility.dllAccessibility.dllSMDiagnostics.dllSMDiagnostics.dll@W source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\System.pdb= source: systemware.exe, 00000004.00000002.1615664818.0000000005090000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: systemware.exe, 00000004.00000002.1602907003.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: HPXo,C:\Windows\System.pdb source: systemware.exe, 00000004.00000002.1602361908.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdbL0Tw# source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdb< source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036383 - Severity 1 - ET MALWARE Common RAT Connectivity Check Observed : 192.168.2.9:49754 -> 208.95.112.1:80
Source: Network traffic	Suricata IDS: 2036383 - Severity 1 - ET MALWARE Common RAT Connectivity Check Observed : 192.168.2.9:49743 -> 208.95.112.1:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: X&\ @p)8I)-qX$

Uses dynamic DNS services

Source: unknown

DNS query: name: erbaevbann3.ddns.net

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost

Yara detected Generic Downloader

Source: Yara match	File source: intro.avi.exe, type: SAMPLE
Source: Yara match	File source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: erbaevbann3.ddns.net

Source: intro.avi.exe, systemware.exe.0.dr	String found in binary or memory: http://api.ipify.org/
Source: intro.avi.exe, systemware.exe.0.dr	String found in binary or memory: http://freegeoip.net/xml/
Source: intro.avi.exe, 00000000.00000002.1376092522.00000000029A7000.00000004.00000800.00020000.00000000.sdmp, intro.avi.exe, 00000000.00000002.1376092522.00000000029BA000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B47000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: intro.avi.exe, systemware.exe.0.dr	String found in binary or memory: http://ip-api.com/json/
Source: intro.avi.exe, 00000000.00000002.1376092522.00000000029BA000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: intro.avi.exe, 00000000.00000002.1376092522.00000000029A7000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\system\systemware.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: intro.avi.exe, type: SAMPLE
Source: Yara match	File source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: intro.avi.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: intro.avi.exe, type: SAMPLE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: intro.avi.exe, type: SAMPLE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: intro.avi.exe, type: SAMPLE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: intro.avi.exe, type: SAMPLE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: QuasarRAT payload Author: ditekSHen
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Windows_Trojan_Quasarrat_e52df647 Author: unknown
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detect QuasarRAT (reted from samples 2023-03) Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: detect Remcos in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: QuasarRAT payload Author: ditekSHen

Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 0_2_00F7A550	0_2_00F7A550
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 0_2_00F79C80	0_2_00F79C80
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 0_2_00F79938	0_2_00F79938
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_02A3A550	4_2_02A3A550
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_02A39C80	4_2_02A39C80
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_02A39938	4_2_02A39938
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_0559DBA8	4_2_0559DBA8
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_0559B780	4_2_0559B780
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_06845020	4_2_06845020
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 7_2_0103A550	7_2_0103A550
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 7_2_01039C80	7_2_01039C80
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 7_2_0103D324	7_2_0103D324
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 7_2_0103D328	7_2_0103D328
Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 7_2_01039938	7_2_01039938
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 16_2_0557A550	16_2_0557A550
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 16_2_05579C80	16_2_05579C80
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 16_2_0557D319	16_2_0557D319
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 16_2_0557D328	16_2_0557D328
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 16_2_05579938	16_2_05579938

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 2312

Source: intro.avi.exe, 00000000.00000000.1349315846.000000000064A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexTSR-build.exe$ vs intro.avi.exe
Source: intro.avi.exe	Binary or memory string: OriginalFilenamexTSR-build.exe$ vs intro.avi.exe

Source: intro.avi.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: intro.avi.exe, type: SAMPLE	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: intro.avi.exe, type: SAMPLE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: intro.avi.exe, type: SAMPLE	Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: intro.avi.exe, type: SAMPLE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: intro.avi.exe, type: SAMPLE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: intro.avi.exe, type: SAMPLE	Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: intro.avi.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: intro.avi.exe, type: SAMPLE	Matched rule: implant_win_quasarrat author = Sekoia.io, description = Detect QuasarRAT (reted from samples 2023-03), creation_date = 2023-03-17, classification = TLP:CLEAR, version = 1.0, reference = https://blog.alyac.co.kr/5103, id = 492fdffc-8e5f-4225-a2eb-cd6d80e6bcb8
Source: intro.avi.exe, type: SAMPLE	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: intro.avi.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: intro.avi.exe, type: SAMPLE	Matched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: implant_win_quasarrat author = Sekoia.io, description = Detect QuasarRAT (reted from samples 2023-03), creation_date = 2023-03-17, classification = TLP:CLEAR, version = 1.0, reference = https://blog.alyac.co.kr/5103, id = 492fdffc-8e5f-4225-a2eb-cd6d80e6bcb8
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: implant_win_quasarrat author = Sekoia.io, description = Detect QuasarRAT (reted from samples 2023-03), creation_date = 2023-03-17, classification = TLP:CLEAR, version = 1.0, reference = https://blog.alyac.co.kr/5103, id = 492fdffc-8e5f-4225-a2eb-cd6d80e6bcb8
Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Windows_Trojan_Quasarrat_e52df647 reference_sample = a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d, os = windows, severity = x86, creation_date = 2021-06-27, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Quasarrat, fingerprint = c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815, id = e52df647-c197-4790-b051-8951fba80c3b, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Quasar_RAT_1 date = 2017-04-07, hash4 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash3 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, hash2 = 1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec, hash1 = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Quasar_RAT_2 date = 2017-04-07, hash3 = f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34, hash2 = 515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89, author = Florian Roth, description = Detects Quasar RAT, reference = https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Vermin_Keylogger_Jan18_1 date = 2018-01-29, hash5 = 24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18, hash4 = 4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da, hash3 = 0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6, hash2 = e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7, hash1 = 74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d, author = Florian Roth, description = Detects Vermin Keylogger, hash6 = 2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef, reference = https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: xRAT_1 date = 2017-12-11, hash2 = f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a, hash1 = 92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b, author = Florian Roth, description = Detects Patchwork malware, reference = https://goo.gl/Pg3P4W, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_KeyLogger_1 date = 2018-02-08, hash1 = c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: implant_win_quasarrat author = Sekoia.io, description = Detect QuasarRAT (reted from samples 2023-03), creation_date = 2023-03-17, classification = TLP:CLEAR, version = 1.0, reference = https://blog.alyac.co.kr/5103, id = 492fdffc-8e5f-4225-a2eb-cd6d80e6bcb8
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: Quasar hash1 = 390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724, author = JPCERT/CC Incident Response Group, description = detect Remcos in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED	Matched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload

Source: intro.avi.exe, -------.cs

Base64 encoded string: 'wpc4i3jGJFKYLVxyxGaLL27fjpIrdIQHv5hjv5o726VOAX4BS0vxT62TQDbkGzxq+tEPlLqP1h57lIngR52ISw==', 's0Xs09pXFDJcJYxa0tOpN96Thj+9aVkIrrJk41FoWTonSZko8yNZYj6/naSfwiS0Dexe7BWheSPW7ApOH7hrqw==', 'ppW7gC14+li12gQDJXkAmjL4/ENhW5fghxtkQjuU6hTcq9rvjaAa5QewDMqAbFyaqfgzd35D4Q3JkOvpHZ2DUw==', 'p9n2yx69vn6093ZmrvikMUD2+5cnZZ3Olgcfp7cwDhXJBCMxaut5BcQrGJCxAFJW3WRByXKs4LNsQmv8Ii0yWYiKb1sZkaeO+6b8gl8H860=', 'WJmsY0ZyzdePtM5DfeccMqOIT3i7QRPSpbZqdoSALbBqHqWOf3q0ypRQFt4/KXSaaKo5k2bjgpWxj/l2id4Dpg==', 'uMQR90lGHe58u+RlE/KGkjfSEmqvxPG3XRAFAAfXZPYbEu14imhrS0OE1DU3hnfdh8CxzVw8YMfi/bY/cbikvg==', 'OON3hkf2dDZzCzAbWq7iDUJUeaBxX1LfLyyuW9ZiUCBbOLn/3nxsdZAkH6RKMwaxpvh7AvPX25BuzIj93Ff7eQ=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/11@2/1

Source: C:\Users\user\Desktop\intro.avi.exe

File created: C:\Users\user\AppData\Roaming\system

Jump to behavior

Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Mutant created: \Sessions\1\BaseNamedObjects\xTSR_MUTEX_tDOmSpZY0vhNMbdmkR
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7740
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

File created: C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat

Jump to behavior

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" "

Source: intro.avi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: intro.avi.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: intro.avi.exe	Virustotal: Detection: 84%
Source: intro.avi.exe	ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\intro.avi.exe

File read: C:\Users\user\Desktop\intro.avi.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\intro.avi.exe "C:\Users\user\Desktop\intro.avi.exe"
Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\intro.avi.exe C:\Users\user\Desktop\intro.avi.exe
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 2312
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"
Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chcp.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\system\systemware.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: intro.avi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: intro.avi.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Runtime.Serialization.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ServiceModel.Internals.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.ni.pdbRSDSg@h source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Users\user\AppData\Roaming\system\systemware.PDB source: systemware.exe, 00000004.00000002.1615832564.000000000512F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.pdbpdbtem.pdb source: systemware.exe, 00000004.00000002.1615832564.000000000512F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Accessibility.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\system\systemware.PDB source: systemware.exe, 00000004.00000002.1602361908.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: SMDiagnostics.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb~ source: systemware.exe, 00000004.00000002.1615832564.0000000005108000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbSystem.Management.ni.dll source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp, WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: mscorlib.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdbAccessibility.dllAccessibility.dllSMDiagnostics.dllSMDiagnostics.dll@W source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\System.pdb= source: systemware.exe, 00000004.00000002.1615664818.0000000005090000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: systemware.exe, 00000004.00000002.1602907003.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: HPXo,C:\Windows\System.pdb source: systemware.exe, 00000004.00000002.1602361908.0000000000AF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Runtime.Serialization.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Xml.pdbL0Tw# source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.pdb< source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.ni.pdb source: WER24CC.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER24CC.tmp.dmp.14.dr

Source: C:\Users\user\Desktop\intro.avi.exe	Code function: 0_2_00F797C6 pushad ; retf		0_2_00F797C9
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Code function: 4_2_06844FF1 push es; ret		4_2_06845000

Source: C:\Users\user\Desktop\intro.avi.exe

File created: C:\Users\user\AppData\Roaming\system\systemware.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\intro.avi.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\intro.avi.exe	File opened: C:\Users\user\Desktop\intro.avi.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	File opened: C:\Users\user\AppData\Roaming\system\systemware.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	File opened: C:\Users\user\AppData\Roaming\system\systemware.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost			Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: F70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: 4940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: 10A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Memory allocated: F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: 3030000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Window / User API: threadDelayed 1199			Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Window / User API: threadDelayed 479			Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe TID: 7640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe TID: 7872	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe TID: 7876	Thread sleep count: 1199 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe TID: 7876	Thread sleep count: 479 > 30	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe TID: 7896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe TID: 7384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\intro.avi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: systemware.exe, 00000004.00000002.1615832564.0000000005108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Prod_VMware_SATA_CD0
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y&
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: systemware.exe, 00000004.00000002.1602907003.0000000000E09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: intro.avi.exe, 00000000.00000002.1375285314.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 10 localhost	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Roaming\system\systemware.exe "C:\Users\user\AppData\Roaming\system\systemware.exe"	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Users\user\Desktop\intro.avi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Users\user\AppData\Roaming\system\systemware.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Users\user\Desktop\intro.avi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\intro.avi.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Users\user\AppData\Roaming\system\systemware.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\system\systemware.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\intro.avi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: intro.avi.exe, type: SAMPLE
Source: Yara match	File source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: intro.avi.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: intro.avi.exe, type: SAMPLE
Source: Yara match	File source: 0.0.intro.avi.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: intro.avi.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\system\systemware.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	11 Input Capture	121 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	41 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	212 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	11 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
intro.avi.exe	85%	Virustotal		Browse
intro.avi.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar
intro.avi.exe	100%	Avira	HEUR/AGEN.1307418
intro.avi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\AppData\Roaming\system\systemware.exe	100%	Avira	HEUR/AGEN.1307418
C:\Users\user\AppData\Roaming\system\systemware.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\system\systemware.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Quasar

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ip-api.com	208.95.112.1	true	false	high
erbaevbann3.ddns.net	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
X&\ @p)8I)-qX$	true		unknown
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://api.ipify.org/	intro.avi.exe, systemware.exe.0.dr	false	high
http://freegeoip.net/xml/	intro.avi.exe, systemware.exe.0.dr	false	high
http://upx.sf.net	Amcache.hve.14.dr	false	high
http://schemas.datacontract.org/2004/07/	intro.avi.exe, 00000000.00000002.1376092522.00000000029BA000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	intro.avi.exe, 00000000.00000002.1376092522.00000000029A7000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B47000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	intro.avi.exe, 00000000.00000002.1376092522.00000000029A7000.00000004.00000800.00020000.00000000.sdmp, intro.avi.exe, 00000000.00000002.1376092522.00000000029BA000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B47000.00000004.00000800.00020000.00000000.sdmp, systemware.exe, 00000004.00000002.1604487334.0000000002B5A000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583245
Start date and time:	2025-01-02 09:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	intro.avi.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/11@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 55 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 13.107.246.45, 20.190.159.68, 52.149.20.212
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:25:08	API Interceptor	1x Sleep call for process: intro.avi.exe modified
03:25:11	API Interceptor	10x Sleep call for process: systemware.exe modified
03:25:31	API Interceptor	1x Sleep call for process: WerFault.exe modified
08:25:10	Task Scheduler	Run new task: System Ware path: C:\Users\user\Desktop\intro.avi.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	ip-api.com/json
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	ip-api.com/xml
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	ip-api.com/json/?fields=225545
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	ip-api.com/json/?fields=61439

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	random(6).exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	1.exe	Get hash	malicious	XWorm	Browse	13.107.246.45
	installer64v7.1.0.msi	Get hash	malicious	Unknown	Browse	13.107.246.45
	hcxmivKYfL.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	01012025.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26desusertion%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	13.107.246.45
	installer64v9.3.4.msi	Get hash	malicious	Unknown	Browse	13.107.246.45
	TieLoader.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://password-changes.phishwall.net/XMzUzaXgwTnBGZU9XbU9kQnFIZk0vQ3hhQlNtUXJwaExCOTNDYnhpMG92ZHRNQjI5SHhmNUlLTC9JcmVVS2sraDgvUVZtd2YwVFROeGxlbDR0UXBkeGJOUkN3UGliUUNGVHZXWVJ2ek5hZ0FNV290djROWFRxN3JNazM1WlhNOUVLdnlqOEVlbXFaaFROMlltRDFFKzhmU3A0eEl4cE1tMFJmazVYOE5hc25oTjNIR0Q1UzJyNW5wTkNBPT0tLUdCVnp5RnltanNuQnVQWkgtLVA0Uy9TcENHeDltOGdwd282cnZiaEE9PQ==?cid=2317630324	Get hash	malicious	HTMLPhisher, KnowBe4	Browse	13.107.246.45
ip-api.com	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	AimStar.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	L988Ph5sKX.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	kj93GnZHBS.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	ANuh30XoVu.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rivalsanticheat.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	208.95.112.1
	vEtDFkAZjO.exe	Get hash	malicious	RL STEALER, StormKitty	Browse	208.95.112.1
	Fizzy Loader.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	208.95.112.1
	Extreme Injector v3.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	VegaStealer_v2.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer	Browse	208.95.112.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_systemware.exe_86b7df83af42ea155ac2e3f11958857a6c94c44_bafed569_be9eab76-eab3-4d90-b748-c14825b13afb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3453711910818968
Encrypted:	false
SSDEEP:	192:fDUTzCv/A60BU/HwbaSJKYxO3yoyVRzuiFRZ24IO83j:ITzCv/OBU/Ca53yomzuiFRY4IO8T
MD5:	73C77CCD2A50AA10F87969F4461AB710
SHA1:	33FB16CD0FD5FAFAE4457FBFF2D4E8EB6F30D509
SHA-256:	B77BCB99B1B6E198D896487F5A20A35AE075AD567346EE16D573DAC84237FE73
SHA-512:	651E429C5214FE3E25C567790EAC5F1976451466925767DCE5B7C5704775518005A567B33004B338BE43FA51F845E399E9E7AEC539019BC4F59423C0CC8787D4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.2.7.9.9.1.2.5.3.3.1.9.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.2.7.9.9.1.3.3.4.5.6.7.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.9.e.a.b.7.6.-.e.a.b.3.-.4.d.9.0.-.b.7.4.8.-.c.1.4.8.2.5.b.1.3.a.f.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.1.a.5.c.7.b.c.-.d.9.7.c.-.4.5.b.8.-.a.3.c.c.-.7.b.a.4.a.1.7.f.3.0.3.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.y.s.t.e.m.w.a.r.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.x.T.S.R.-.b.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.3.c.-.0.0.0.1.-.0.0.1.4.-.2.8.7.2.-.8.9.d.5.e.f.5.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.c.5.f.1.e.b.4.2.0.c.0.0.a.0.9.b.5.d.0.e.f.e.4.b.2.5.7.e.4.c.3.0.0.0.0.0.0.0.0.!.0.0.0.0.1.2.3.e.5.1.1.d.e.2.0.b.e.a.b.7.b.f.a.2.b.e.a.5.c.2.2.0.6.4.2.2.b.c.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER24CC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 08:25:12 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	370440
Entropy (8bit):	3.4975131378558695
Encrypted:	false
SSDEEP:	3072:ik9qcsk+kMjBFAJV18QvKuUGb2gO4uEqN8wLTgGyvBhje14:ik9RsPAX1xXnO4MTgGyZhj1
MD5:	360F11C4ECFCA1AA6AD8C5A917F8A142
SHA1:	6B312CB894B74D35ADB965E0FDB5FCCD855D9FFD
SHA-256:	11403BBA0E5FF3DF0108A1FD70E35053B229661F28748CDAAFF8DE7BCBFAE161
SHA-512:	E0EC0B5F0BF948F15ABC72824032929F392484BC821B73A398F898ACBEFD48868DE8B36A1ABEB2052499FFD2FE67EA9AA7E9E95106826E8F7D3AFA46F183E970
Malicious:	false
Preview:	MDMP..a..... .......hMvg............d............(..x.......<....2.......3...w..........`.......8...........T........... Y...M...........2...........4..............................................................................eJ......P5......GenuineIntel............T.......<...dMvg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER26E0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8372
Entropy (8bit):	3.689154830308844
Encrypted:	false
SSDEEP:	192:R6l7wVeJxR626YG565ZRgmfZNmprV89bp+sfbDm:R6lXJn626YY63RgmfT5p9fO
MD5:	C7CB1E369C2E14FA6A5958FC236446EF
SHA1:	CA8FF6F64FCE94E7111CB3AB52F2326A9F4C89E9
SHA-256:	0A7885B1DEDC836C68A0F14A1A3F7C727417541E2EBA506F8F96D5BAD7C63815
SHA-512:	E112B9426E14D365B181788B4DF9820DC7F25FD3A2A76C1DAC2136EAFA9743CC297645BDCFD3B43DEC2FCDBB4468EFE717248D8D607D223FD0D68C08839198BF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2720.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.450580389789792
Encrypted:	false
SSDEEP:	48:cvIwWl8zseJg77aI9SkgWpW8VY1c0Ym8M4Jd16Fu2+q8vP1I6a6vttjzd:uIjfUI7FZ7V+WJwKO6Vvjjzd
MD5:	E062F75667BE9874654753ADC31D31E5
SHA1:	39ACB642242751EFC9AB905EE3D15C7B9BD85C4E
SHA-256:	A321CF6A36CD797568E4FB873658F74F264995470933C2D65D881DCA0C785002
SHA-512:	E6C30047866B5C2EB7F58C5173C458C5319B9D11CEB20723098A148D935FB44A2CB6EBC8FD718E1678B2C72815B0A20921A2B64296E458CD95A0950CA72A8C21
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658047" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\intro.avi.exe.log

Download File

Process:	C:\Users\user\Desktop\intro.avi.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1682
Entropy (8bit):	5.350187081398599
Encrypted:	false
SSDEEP:	48:MIHK5HKH1qHiYHKh3okHZHKJHKntHo6hAHKzetTH3:Pq5qHwCYqh3ok5qJqntI6eqzIX
MD5:	AE7F2402D6C6DD5CF582BB8A9AB7D8F0
SHA1:	82E5A0C6F7F00154651327157E4BE6DF7AB3CEB6
SHA-256:	2F09AEFCAFBB43457F64CDCD43992C51562214AC95CFAA7DEB0E9202E3E816A6
SHA-512:	2FD6464EB55D5C175FE6C90AC1A037AAF0DD0B3ECDEA55862387436AF4D4833B1CCC763C19F80DCAF49D57D57B37087955EED5B7BF1B962FE9A4F7BE0D1DC5FE
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\systemware.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\system\systemware.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	826
Entropy (8bit):	5.353295152847208
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhBsXE4qdKm:MIHK5HKH1qHiYHKh3okHA
MD5:	CBC102AE9B2B802A4E451ED79E09DEB5
SHA1:	7102EB28C2A703B2AA74F5E419A2D72C66B97896
SHA-256:	0763878B1A8876F16EE532AB23C36782096C2A8CD770C18C6CB1156121734EFB
SHA-512:	CDB7367250343E2DD31876C3B337A0FF6A6E2A7E37FF71C0C8AE7072302FC014BBDE14689C16E25E80D2B1587DFC75FA6BE50AFD0D06083A2A09BD0D256151C7
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\96012833bebd5f21714fc508603cda97\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat

Download File

Process:	C:\Users\user\AppData\Roaming\system\systemware.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	209
Entropy (8bit):	5.319082875244265
Encrypted:	false
SSDEEP:	6:hC47bxrBeLuVFOOr+DE1qLTwiaZ5QWUovKOZG1qLTwi23fFy:d5r+uVEOCDEqwNHDjwZQ
MD5:	EF68A86AA0AB72C8E7E88F70D3E787D3
SHA1:	01D2E6D9A749FF2ADDD532C5AAABEB7562EADF55
SHA-256:	09102FDCFF800FBB49E3133FC79AC95ECE2B21C8B57330130A413FF23CD9ADA9
SHA-512:	79D984A9EDAEC99DAEC517D8869CE39E940F4497F2256012C61A356D236B95F20F79224511B60DAE323240DBD39BCB8FF54232FB468C9D65070A7F8111AE490B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..echo DONT CLOSE THIS WINDOW!..ping -n 10 localhost > nul..start "" "C:\Users\user\AppData\Roaming\system\systemware.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat"

C:\Users\user\AppData\Roaming\logs\01-02-2025

Download File

Process:	C:\Users\user\AppData\Roaming\system\systemware.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	7.009167477774236
Encrypted:	false
SSDEEP:	6:d1cQL3Lw4x/SK4QD7rfZdDTG9giaw5NN/cIsfaid:dA4x/e6ldDTu5QIVid
MD5:	4512C40AFCB3597FE82CDFA9C151DEA1
SHA1:	9AFBF0123F947887C015442EFE6BEE6C74E7EBAE
SHA-256:	24205732A2B2C0C35132E65284F2BD578409C06011EDF008F15091247B758654
SHA-512:	C7939BEFA22B9ED4CE5F96A8F679221135FB5A898A931B29E2D7B9C54E619100C0CF4A7A6343CE5DDE1C81C9D0139E79FA13B5114D7917BF3535B5F86DE7D330
Malicious:	false
Preview:	f?K..W......{.........}....b2...w.H`>.z!.7P..{..[U/..h.M.....s...-9>....f.>.\|....6."A.}.....^.C\|_.Vgj..#{........)m..ZBY.!HU...st;.......l.G{.....Ys.O..LV...r.\|.\|.)....oG.L.w.S...yt..+..>zX...v..lVT..#l(.Z......

C:\Users\user\AppData\Roaming\system\systemware.exe

Download File

Process:	C:\Users\user\Desktop\intro.avi.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	356352
Entropy (8bit):	6.428476781574683
Encrypted:	false
SSDEEP:	6144:0I6bPXhLApfpMMoDMWZVGZV+RzbLirAeMB2Wku:FmhApypOrAeMB2/u
MD5:	D219D94CABAA00E5ABFFC599BDEEF75D
SHA1:	123E511DE20BEAB7BFA2BEA5C2206422BC5E8241
SHA-256:	3CC847687E60ACDA504FC35577F36EEDD0BCA559A4DE915D6DD88DB9178567D4
SHA-512:	82DBB2484E3E42FCD6C3914DA4EBFC540E135B8B57BF240A28A3E9FCEB6409D8A9B1F9CA9B4BF545D05A10FD9B1672A2A6A05D963AAA33F4905E74CC1C068734
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Joe Security Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: unknown Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: Quasar_RAT_2, Description: Detects Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: Vermin_Keylogger_Jan18_1, Description: Detects Vermin Keylogger, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: xRAT_1, Description: Detects Patchwork malware, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: CN_disclosed_20180208_KeyLogger_1, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: implant_win_quasarrat, Description: Detect QuasarRAT (reted from samples 2023-03), Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Sekoia.io Rule: Quasar, Description: detect Remcos in memory, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarRAT, Description: QuasarRAT payload, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.................b............... ........@.. ....................................@.................................`...K.................................................................................... ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............n..............@..B........................H...........P...............H............................................0..K.......(.....(....(...........s....o....(....,.(....,.(;...-.~....o@...(....(.....n~....-.(....,.(.....(.....0..=........o....,4(......(....,.s....%.o....%.o....%.o....(....&(........0..N.......(....~....,.~....o....~....,.~....o....~....,.~....o....~....o..........(.......0..n.......~....(....sz....~....(....,..oy...-.~....(....,..*~....~....(....~....~....(....,.r...p+.~....r...p(....~....(..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.394147284571219
Encrypted:	false
SSDEEP:	6144:ul4fiJoH0ncNXiUjt10qIG/gaocYGBoaUMMhA2NX4WABlBuNAlOBSqa:u4vFIMYQUMM6VFYSlU
MD5:	1A1DBC0BEA41DAA76CCBBF46DF1C8119
SHA1:	95C8B779C6D2DEFC8CDDB6B0EB2DE9C18ABC311D
SHA-256:	6B759F05E9C35F21E422FD9A7859CD071A9892DAA3498AFA375EF4B7050062E9
SHA-512:	D31BE3EA14454F922CDB4E8F8DE33E80A215BE96B536669015D2156D6F05CF76A8997281776CE56761E91E98FC5D49A40F30E7504AD790A4AD3524D4B249769F
Malicious:	false
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.Q...\..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.620443687137824
Encrypted:	false
SSDEEP:	12:P85pTcgTcgTcgTcgTcgTcgTcgTcgTcgTLs4oS/AFSkIrxMVlmJHaVzvv:2dUOAokItULVDv
MD5:	E657565E43A32E9BF009FB85D0E5FBA7
SHA1:	30194532C99B88ABDB7B0E6F15FA2BEC890E3176
SHA-256:	E025DDDFCBCCF6DF8627C54454938BBFA79A61B6304318B78FEFBF49A042440A
SHA-512:	C4295AAB84357A6EE845B64B254C247E2CF8564F383CACD2E34B6FC74288234852FF7D3F4213C79E4617C86B653C6643D1927F31275620D7E15D18EAF5BE4FBF
Malicious:	false
Preview:	..Pinging 707748 [::1] with 32 bytes of data:..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ..Reply from ::1: time<1ms ....Ping statistics for ::1:.. Packets: Sent = 10, Received = 10, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.428476781574683
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	intro.avi.exe
File size:	356'352 bytes
MD5:	d219d94cabaa00e5abffc599bdeef75d
SHA1:	123e511de20beab7bfa2bea5c2206422bc5e8241
SHA256:	3cc847687e60acda504fc35577f36eedd0bca559a4de915d6dd88db9178567d4
SHA512:	82dbb2484e3e42fcd6c3914da4ebfc540e135b8b57bf240a28a3e9fceb6409d8a9b1f9ca9b4bf545d05a10fd9b1672a2a6a05d963aaa33f4905e74cc1c068734
SSDEEP:	6144:0I6bPXhLApfpMMoDMWZVGZV+RzbLirAeMB2Wku:FmhApypOrAeMB2/u
TLSH:	47747C2377A4EE3BD1BE277AF432051447B0D44BB616E38B5A6855F82C233868D907B7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^.................b............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4581ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EB119F5 [Tue May 5 07:47:01 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x58160	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5a000	0xa00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x561b4	0x56200	664d020825ea7d481fc023a0fdff5c2e	False	0.5132126496734397	data	6.44528477979618	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x5a000	0xa00	0xa00	035b89cb323e59652dce8def98c7c00b	False	0.3546875	data	4.237788371045753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5c000	0xc	0x200	bd28a940eee11fd64e88302faf080856	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x5a0a0	0x308	data			0.4497422680412371
RT_MANIFEST	0x5a3a8	0x478	exported SGML document, Unicode text, UTF-8 (with BOM) text			0.4423076923076923

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T09:25:09.395784+0100	2036383	ET MALWARE Common RAT Connectivity Check Observed	1	192.168.2.9	49743	208.95.112.1	80	TCP
2025-01-02T09:25:11.739551+0100	2036383	ET MALWARE Common RAT Connectivity Check Observed	1	192.168.2.9	49754	208.95.112.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:25:08.801822901 CET	49743	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:08.806643963 CET	80	49743	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:08.806824923 CET	49743	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:08.807089090 CET	49743	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:08.811933041 CET	80	49743	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:09.339253902 CET	80	49743	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:09.395783901 CET	49743	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:09.953116894 CET	49743	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:11.198254108 CET	49754	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:11.207022905 CET	80	49754	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:11.210035086 CET	49754	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:11.210459948 CET	49754	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:11.215617895 CET	80	49754	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:11.693846941 CET	80	49754	208.95.112.1	192.168.2.9
Jan 2, 2025 09:25:11.739551067 CET	49754	80	192.168.2.9	208.95.112.1
Jan 2, 2025 09:25:34.253534079 CET	49754	80	192.168.2.9	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 09:25:08.785389900 CET	62190	53	192.168.2.9	1.1.1.1
Jan 2, 2025 09:25:08.792172909 CET	53	62190	1.1.1.1	192.168.2.9
Jan 2, 2025 09:25:12.881759882 CET	58326	53	192.168.2.9	1.1.1.1
Jan 2, 2025 09:25:12.890490055 CET	53	58326	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 09:25:08.785389900 CET	192.168.2.9	1.1.1.1	0x6c33	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:25:12.881759882 CET	192.168.2.9	1.1.1.1	0xd49f	Standard query (0)	erbaevbann3.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 09:25:02.138863087 CET	1.1.1.1	192.168.2.9	0xebd6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 09:25:02.138863087 CET	1.1.1.1	192.168.2.9	0xebd6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 09:25:08.792172909 CET	1.1.1.1	192.168.2.9	0x6c33	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49743	208.95.112.1	80	7560	C:\Users\user\Desktop\intro.avi.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 09:25:08.807089090 CET	144	OUT	GET /json/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 Host: ip-api.com Connection: Keep-Alive
Jan 2, 2025 09:25:09.339253902 CET	483	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 08:25:09 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49754	208.95.112.1	80	7740	C:\Users\user\AppData\Roaming\system\systemware.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 09:25:11.210459948 CET	144	OUT	GET /json/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0 Host: ip-api.com Connection: Keep-Alive
Jan 2, 2025 09:25:11.693846941 CET	483	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 08:25:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	03:25:06
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\intro.avi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\intro.avi.exe"
Imagebase:	0x5f0000
File size:	356'352 bytes
MD5 hash:	D219D94CABAA00E5ABFFC599BDEEF75D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: Florian Roth Rule: implant_win_quasarrat, Description: Detect QuasarRAT (reted from samples 2023-03), Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: Sekoia.io Rule: Quasar, Description: detect Remcos in memory, Source: 00000000.00000000.1349274211.00000000005F2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:25:08
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\Desktop\intro.avi.exe" /rl HIGHEST /f
Imagebase:	0xd00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:25:08
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:25:08
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Roaming\system\systemware.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\system\systemware.exe"
Imagebase:	0x6b0000
File size:	356'352 bytes
MD5 hash:	D219D94CABAA00E5ABFFC599BDEEF75D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Joe Security Rule: Windows_Trojan_Quasarrat_e52df647, Description: unknown, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: unknown Rule: Quasar_RAT_1, Description: Detects Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: Quasar_RAT_2, Description: Detects Quasar RAT, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: Vermin_Keylogger_Jan18_1, Description: Detects Vermin Keylogger, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: xRAT_1, Description: Detects Patchwork malware, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: CN_disclosed_20180208_KeyLogger_1, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Florian Roth Rule: implant_win_quasarrat, Description: Detect QuasarRAT (reted from samples 2023-03), Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: Sekoia.io Rule: Quasar, Description: detect Remcos in memory, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: ditekSHen Rule: MALWARE_Win_QuasarRAT, Description: QuasarRAT payload, Source: C:\Users\user\AppData\Roaming\system\systemware.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:25:10
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"schtasks" /create /tn "System Ware" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\system\systemware.exe" /rl HIGHEST /f
Imagebase:	0xd00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:25:10
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:25:10
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\intro.avi.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\intro.avi.exe
Imagebase:	0x690000
File size:	356'352 bytes
MD5 hash:	D219D94CABAA00E5ABFFC599BDEEF75D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:25:11
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat" "
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:25:11
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:25:12
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x90000
File size:	12'800 bytes
MD5 hash:	20A59FB950D8A191F7D35C4CA7DA9CAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:25:12
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 10 localhost
Imagebase:	0xdb0000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:25:12
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7740 -s 2312
Imagebase:	0xdd0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:25:21
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Roaming\system\systemware.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\system\systemware.exe"
Imagebase:	0xda0000
File size:	356'352 bytes
MD5 hash:	D219D94CABAA00E5ABFFC599BDEEF75D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	54
Total number of Limit Nodes:	5

Executed Functions

Function 00F79C80 Relevance: .3, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bf7ebb96c79c40221eec7a7056f56dd3b3cd00193521c6d4d71461330ad7c0
Instruction ID: 06f6cfa17851676145e63657bf70eeb370ac33d8bce49e4c1443a06917002090
Opcode Fuzzy Hash: 31bf7ebb96c79c40221eec7a7056f56dd3b3cd00193521c6d4d71461330ad7c0
Instruction Fuzzy Hash: EFB13071E04209CFDB10CFA9D8857DEBBF2AF88314F14C52AD419E7254EBB49845DB92

Function 00F7A550 Relevance: .3, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365473d3497190e72ce05a617c52f5e42482a2e95d6691a59d63ea38cd3102e3
Instruction ID: 1931655cdb88dca6f7fed96e20574189575157d577fdf4d451889368edcc7629
Opcode Fuzzy Hash: 365473d3497190e72ce05a617c52f5e42482a2e95d6691a59d63ea38cd3102e3
Instruction Fuzzy Hash: 0EB16071E00209CFDB14CFA9D88579EBBF2AF88310F19C52AD419E7254EB749846DB83

Function 06470048 Relevance: 1.7, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?, xrefs: 064700AF

Memory Dump Source

Source File: 00000000.00000002.1379402345.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_intro.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: f6c7d542b6e8bce9f0e60a6cec27e2798395cdef3392e24c8cfe827f4e82bf66
Instruction ID: a5589337b69b6e994f2ddcabcd626ee5a263121868b858c62978814939c5dffd
Opcode Fuzzy Hash: f6c7d542b6e8bce9f0e60a6cec27e2798395cdef3392e24c8cfe827f4e82bf66
Instruction Fuzzy Hash: 1EF1B0B4B01205CFEB55DBA5C844BAEBBB2FF88704F14841AE4069B391DB75EC42CB91

Function 00F73334 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F733F1

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c1a9a409c11970b57874852cb9f66e64f4589924d980b677295b03fd7460275e
Instruction ID: d746a20472a01c3d034b3602645706e21dbc2a8b35e866b906e9ef1a8ca09af7
Opcode Fuzzy Hash: c1a9a409c11970b57874852cb9f66e64f4589924d980b677295b03fd7460275e
Instruction Fuzzy Hash: B341EDB0C00759CFDB25CFA9C844BDEBBB1BF49304F20806AD408AB251DBB56A46DF91

Function 00F71978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00F733F1

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b663f88b8976d56260259962a5b9f648c49ce8ce6bc5f48bff710caa9702ca99
Instruction ID: 51915ffd3a54958abc948856e4a758480482cd80c9bdd0519da541858c9a0726
Opcode Fuzzy Hash: b663f88b8976d56260259962a5b9f648c49ce8ce6bc5f48bff710caa9702ca99
Instruction Fuzzy Hash: D641FFB0C00759DFDB24CFAAC844B9EFBB1BF49704F20806AD408AB255DBB56946DF91

Function 00F7FBCA Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00F7FC45), ref: 00F7FCC8

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 6d899edacfd7493b3bf6bdb78af9faeadbc030e8e5a6ef269a92a970760f0150
Instruction ID: 631f4d8a1e44835ae8b79a229687ea4c033f941dc6dd72bbdb1cc71989b37861
Opcode Fuzzy Hash: 6d899edacfd7493b3bf6bdb78af9faeadbc030e8e5a6ef269a92a970760f0150
Instruction Fuzzy Hash: ED31E4B2D143899FCB01DB65D4507AEBFF4EF09310F08846AD448A7252D3745906CFA2

Function 00F7F928 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00F7FC45), ref: 00F7FCC8

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 55278bf4b131d0fd9e28b73a7e3e890ea3537c383e9b2205722898bbdd1bd71d
Instruction ID: eb334f282e40f4548cb8716fdc3bf744f2a011189fc3dd1956c3b622726732d6
Opcode Fuzzy Hash: 55278bf4b131d0fd9e28b73a7e3e890ea3537c383e9b2205722898bbdd1bd71d
Instruction Fuzzy Hash: 44213BB5C006599BCB14CF9AD5447AEFBF4EF48320F14856AD818A7740D374AA45CFE1

Function 06470012 Relevance: 1.5, Strings: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?, xrefs: 064700AF

Memory Dump Source

Source File: 00000000.00000002.1379402345.0000000006470000.00000040.00000800.00020000.00000000.sdmp, Offset: 06470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6470000_intro.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: b1a4343a1cb2ea3394f6414e3b29fd30a1f08d001908adbc253b8a1958dfc08d
Instruction ID: feffd980eef331f3a812d41341dbfebba7f0a1440fbae015cb0d19f0d9f8319b
Opcode Fuzzy Hash: b1a4343a1cb2ea3394f6414e3b29fd30a1f08d001908adbc253b8a1958dfc08d
Instruction Fuzzy Hash: 0C91E1B0B013458FEB159B69C850BAEBBB2FF85704F148566D502DB3E2DA75EC028B91

Function 00F1D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375682964.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f1d000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d1c009373ababce74cb0cf067180ef5838f9f3513048c8857c9c3ae82ee716a
Instruction ID: 29d3327b12ef9aba71d6b4727344297adedc3b28aea5f08c1eec7e9835aeb868
Opcode Fuzzy Hash: 3d1c009373ababce74cb0cf067180ef5838f9f3513048c8857c9c3ae82ee716a
Instruction Fuzzy Hash: F9213A72900344DFDB04DF14D9C0B56BF76FB98328F28856DE8090B256C336D896EBA2

Function 00F1D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375682964.0000000000F1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f1d000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 60bef254be5e2b5015912460c64efd1a27f6a3103f35d47f0984c2a282966607
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: E111E676904240CFCF15CF10D5C4B56BF72FB94328F28C6A9D8090B656C33AD896DBA1

Non-executed Functions

Function 00F79938 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1375862936.0000000000F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3be4f9a3cc0257617f4e28540b2698c8adfa464c4bda05d388af88e860ff36
Instruction ID: 3a8224f8c172f663fe2354fd1c5d4b899f2d0584dfc9dbefb1040891022b24c2
Opcode Fuzzy Hash: bf3be4f9a3cc0257617f4e28540b2698c8adfa464c4bda05d388af88e860ff36
Instruction Fuzzy Hash: 74916D71E04209CFDF10CFA9D8857DEBBF2AF88714F14C12AD409A7294EBB49945DB92

Analysis Process: systemware.exePID: 7740, Parent PID: 7560COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	121
Total number of Limit Nodes:	10

Executed Functions

Function 06845020 Relevance: 1.9, APIs: 1, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af9f35316b0275beba29c07d8f42c0969fa1fc39df060c17b560b5ebcd4f80a4
Instruction ID: 26bfe1d05e35a9cf0471044b79e55e1a2addcd6d034e7e85851f42142f5a6572
Opcode Fuzzy Hash: af9f35316b0275beba29c07d8f42c0969fa1fc39df060c17b560b5ebcd4f80a4
Instruction Fuzzy Hash: 77F12930E00209CFEB54EFA9C944BADBBF2BF48304F158559E509EF265DB74A945CB82

Function 06530048 Relevance: 1.7, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?, xrefs: 065300AF

Memory Dump Source

Source File: 00000004.00000002.1617297078.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6530000_systemware.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 31a2241e07bffcdfdf66e27f250d4167296c2698baae36620d837ba8504eec49
Instruction ID: 49cd7d7452d5f7e8467e574268bfd1aeed116ddfa0bf4e14a02f6ebe659c0165
Opcode Fuzzy Hash: 31a2241e07bffcdfdf66e27f250d4167296c2698baae36620d837ba8504eec49
Instruction Fuzzy Hash: FFF18A30B003198FEB55DBA5C954BAEBBB2BF88B00F148459E4069B395DB75EC42CB91

Function 0684AB10 Relevance: 1.7, APIs: 1, Instructions: 157
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0684ABD0

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: f23c201df0750949243dfadbd7a0744cf94eb711e5df5d6511dbe3e833a3a126
Instruction ID: d96cdc682aaf570a88c30c7048d2e983f98fd8cfe09c69422a1c86e09b577e42
Opcode Fuzzy Hash: f23c201df0750949243dfadbd7a0744cf94eb711e5df5d6511dbe3e833a3a126
Instruction Fuzzy Hash: 86612674E4021DDFEB58EF99D494BADBBB1BF48304F148059E811AB394CB799885CB90

Function 02A33334 Relevance: 1.6, APIs: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A333F1

Memory Dump Source

Source File: 00000004.00000002.1603781527.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a30000_systemware.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a21668852376c7aca3bb90bb3ea7a3c1e5ef7fe01260ef32c285301c1ab6ffe8
Instruction ID: 4f53f66edc9a08c5b0005de19dd56ccfb095160a6aeb6c6b83ca3411b0bb74bd
Opcode Fuzzy Hash: a21668852376c7aca3bb90bb3ea7a3c1e5ef7fe01260ef32c285301c1ab6ffe8
Instruction Fuzzy Hash: F341FE71C046598FEB21CFA9C8447DEFBB1AF88314F2080AAD408AB251DB75594ACF90

Function 0559F6A5 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0559F7C2

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3fc89d4a714ae9652fff17b80b319e1c6cb387e6339de2a6f78579d5c810504a
Instruction ID: 2e54b1d653c94763d883ef068a58961de650a39b5f7da0a817cfdee6305d448b
Opcode Fuzzy Hash: 3fc89d4a714ae9652fff17b80b319e1c6cb387e6339de2a6f78579d5c810504a
Instruction Fuzzy Hash: EC51C1B5D143499FDF15CFA9C884ADEBBB1BF48314F24822AE419AB250D7749885CF90

Function 0559F6B0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0559F7C2

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b052199d0b4518d161ee78657d0835c4468c8ba95e7744d48ca3cb2be2c120ca
Instruction ID: 1c55a6feee4b72a449f11537115ac8ff022f877ede57f3f1f0a2d959a09da1be
Opcode Fuzzy Hash: b052199d0b4518d161ee78657d0835c4468c8ba95e7744d48ca3cb2be2c120ca
Instruction Fuzzy Hash: 9C41C0B5D10309AFDF15CF99C884ADEBBB5FF48310F24812AE819AB210D774A885CF90

Function 02A3FBA7 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1603781527.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a30000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622b9ec9dae13bc2e81eb5ab0881c037afd27dcc4cec6692fc2595427120dbbf
Instruction ID: fce4e2b85ac0e0b1c4541a96158ddf85708f0100859ad7f51ddbf9ab8210d3a9
Opcode Fuzzy Hash: 622b9ec9dae13bc2e81eb5ab0881c037afd27dcc4cec6692fc2595427120dbbf
Instruction Fuzzy Hash: 4B41D172C293958FE702CF78D8A07D9BFB0EF06214F05819BD484DB252D7389949CB96

Function 02A31978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02A333F1

Memory Dump Source

Source File: 00000004.00000002.1603781527.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a30000_systemware.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1fbf3e9e304afd0fd7a49745fc1c1b536499a6cf4097c11612f0735be4511809
Instruction ID: b85bd4cf8c263a13eb2a1d3b5526f72ee4c2c44cb86b14ef7f722d7afa0e869f
Opcode Fuzzy Hash: 1fbf3e9e304afd0fd7a49745fc1c1b536499a6cf4097c11612f0735be4511809
Instruction Fuzzy Hash: 5A41D1B0C04719DFEB25CFA9C844B9EFBB5BF49704F2080AAD409AB251DB756945CF90

Function 06842070 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06842131

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4d4d478dfc2dff0911a5d8bb4d41d85516bc4dc398fd67c084df1fcdc877802e
Instruction ID: b27f4d0a35cd8962bdd7bf3af44c298b9961163e4092afc37245ce99f3aade6e
Opcode Fuzzy Hash: 4d4d478dfc2dff0911a5d8bb4d41d85516bc4dc398fd67c084df1fcdc877802e
Instruction Fuzzy Hash: C54129B4A002098FDB14DF59C848A9EFBF5FF88314F24C459E518A7321D775A941CFA0

Function 0684B018 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0684B0AA

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4a31894d7afdb234166ff7b2ad473750697cbd2d10f149efc3dba0ec22497808
Instruction ID: 7de0389b4cb00530037e9143f05275a1d260e037d86e1425c7a33243855aa592
Opcode Fuzzy Hash: 4a31894d7afdb234166ff7b2ad473750697cbd2d10f149efc3dba0ec22497808
Instruction Fuzzy Hash: 433178B490024A8FDB10DF99D840A9EFBF0FF48304F148559D454AB311D774A944CFA1

Function 0684B028 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0684B0AA

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 32d74f5c3f1afe3053fc4a1c447340c5bc4d6a233dddfec054ce617188b4c0c5
Instruction ID: 27237ebb5ced8cdde894e7f4a9de26dd3205d3c054912a17ed255468d4399011
Opcode Fuzzy Hash: 32d74f5c3f1afe3053fc4a1c447340c5bc4d6a233dddfec054ce617188b4c0c5
Instruction Fuzzy Hash: 5A2153B890024A8FDB10DFAAD844B9EFBF0FF48314F148559D419AB311D774A948CFA2

Function 0684992C Relevance: 1.6, APIs: 1, Instructions: 62
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,058BD49E,?,?,?,00000E20,?,?,0684B0F8,03AE42D8,02B994B4), ref: 0684B189

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 046f324ff729b9e2a844184b93c8eba84dcd84fc599cb8bcfc98213341f792d0
Instruction ID: dcc62ee2092c0092fdafabe8f9cd0848a5cfb7345c3a9666a237285e7f93c18d
Opcode Fuzzy Hash: 046f324ff729b9e2a844184b93c8eba84dcd84fc599cb8bcfc98213341f792d0
Instruction Fuzzy Hash: 3A211371D002099FDB50DFAAC844BEEFBF5FB88320F14842AD558A3250D778A944CFA5

Function 0559D528 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0559D596

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a823767b8ed62f80ed030faae8a4327205906c195b90c3b4aeed2bea2207a6d8
Instruction ID: 9711b1ea8ffa664b40e60ffb716974e641d0e6ef6c5c1459ed4c93582cf1988b
Opcode Fuzzy Hash: a823767b8ed62f80ed030faae8a4327205906c195b90c3b4aeed2bea2207a6d8
Instruction Fuzzy Hash: 162177B5C042498FDB20CFAAC844A9EFBF4FB49214F14855AD459A7250C379A145CFA1

Function 02A3F928 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,02A3FC45), ref: 02A3FCC8

Memory Dump Source

Source File: 00000004.00000002.1603781527.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a30000_systemware.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d56b1ffbc90e7fa39feb19912a4b487065c0b745efce31374ea59480da99e29f
Instruction ID: 7f5a99ce4f36d078e75ef6afb8b17b6d3525d61df8b52239067c4dde9ca05c83
Opcode Fuzzy Hash: d56b1ffbc90e7fa39feb19912a4b487065c0b745efce31374ea59480da99e29f
Instruction Fuzzy Hash: F22144B5C1065A9FDB14CF9AC5447AEFBB4EB48320F14816AE818A7740D778A905CFA1

Function 0684B110 Relevance: 1.6, APIs: 1, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,058BD49E,?,?,?,00000E20,?,?,0684B0F8,03AE42D8,02B994B4), ref: 0684B189

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 5f673da9351852461aec0b2c4ff3644b3a74b545eab1bb80ddf72c3d0a50f37b
Instruction ID: caa2dae37a0cd0bd5a8f7b75aaed147e97b207b471e7c2cc8ee5921caf0b0e0b
Opcode Fuzzy Hash: 5f673da9351852461aec0b2c4ff3644b3a74b545eab1bb80ddf72c3d0a50f37b
Instruction Fuzzy Hash: 4F211575D002499FDB14DFAAC884BEEFBF5EB88320F14842AD458A7250D778A944CF61

Function 02A3FC50 Relevance: 1.6, APIs: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,02A3FC45), ref: 02A3FCC8

Memory Dump Source

Source File: 00000004.00000002.1603781527.0000000002A30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2a30000_systemware.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1ce03d26c28e8394645fca68b0750d214a586bfa5c0a299ff21bf3484a0166c1
Instruction ID: 300bea0e8dda23fcc08c0451e4611806eb96f972e2a61b8274f90f5f9f68262c
Opcode Fuzzy Hash: 1ce03d26c28e8394645fca68b0750d214a586bfa5c0a299ff21bf3484a0166c1
Instruction Fuzzy Hash: FD2147B6C1061A9FDB10CFA9C5457DEFBB0EF48210F15812AD818A7640D338A905CFA1

Function 06842190 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06842131

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 48f644699c139bc540cb18d263db474770999c32ad193799030fb04c061cb6c2
Instruction ID: e8b9f12fef44442526158bc6a242390bad14027040f744a2ec5694039f1d1cce
Opcode Fuzzy Hash: 48f644699c139bc540cb18d263db474770999c32ad193799030fb04c061cb6c2
Instruction Fuzzy Hash: DE11CE70D0830ADFDB50EF64E8547EEBBF4EB45314F10854AE25897652C736A641CBA0

Function 0559D530 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0559D596

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b635637cb7b5fcfe0cab4fe74e15bf0759cf45f28f52c0f4b5e42c71b2113d7f
Instruction ID: 502c34c5b4ceb9e89c1bf42bae296ec83c35d5096defbcaa826b1f9b8427a077
Opcode Fuzzy Hash: b635637cb7b5fcfe0cab4fe74e15bf0759cf45f28f52c0f4b5e42c71b2113d7f
Instruction Fuzzy Hash: 3611E0B5C006498FDB14DF9AC444BDEFBF4BB88324F14842AD819B7610D379A545CFA1

Function 0684AE00 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0684AE68

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: a32eef7e6e28257b076e0db61b56cda9f967bea3462868636b5123aeb78c1789
Instruction ID: 564f1b0845f8ac20c7046cff44f3de82e39abfc53e22709a3bec7335a40eeff8
Opcode Fuzzy Hash: a32eef7e6e28257b076e0db61b56cda9f967bea3462868636b5123aeb78c1789
Instruction Fuzzy Hash: 581149B5C043898FDB20CF99C945BDEBFF0BB08314F24445AD6A4AB291C3B96544CF91

Function 06849888 Relevance: 1.5, APIs: 1, Instructions: 47threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0684AE68

Memory Dump Source

Source File: 00000004.00000002.1617581110.0000000006840000.00000040.00000800.00020000.00000000.sdmp, Offset: 06840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6840000_systemware.jbxd

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: de4db7192aac81353e4a37d501380d2770f30bf8b478165617c60b515769f5b9
Instruction ID: 31c51922caf059d0a5f45fe1adf14e5e4b41c840b1cb335a4c599eb114abfafa
Opcode Fuzzy Hash: de4db7192aac81353e4a37d501380d2770f30bf8b478165617c60b515769f5b9
Instruction Fuzzy Hash: 4A1113758402499FEB10DF89C986BDEBBF4EB08314F10880AD565AB240C3B96944CFA5

Function 06530001 Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

?, xrefs: 065300AF

Memory Dump Source

Source File: 00000004.00000002.1617297078.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6530000_systemware.jbxd

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 90872b4f93ce2f48c9928c2f3d0557484b9c9b823982f6b2c1824d341bdc3595
Instruction ID: 8a964ce6d89a1048cff1dc3b170b2a3fc08418f093a83be2bc19ea4295a9f1f4
Opcode Fuzzy Hash: 90872b4f93ce2f48c9928c2f3d0557484b9c9b823982f6b2c1824d341bdc3595
Instruction Fuzzy Hash: 1691FF70B403158FEB158B68C890BAE77B6BF85704F188966D501EF3E2DA75ED02CB91

Function 00CCD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602610908.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ccd000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c7b66d50ccda618286ad69e76d28af360c7f1e4eff31c25162b23907185d18
Instruction ID: cc5bebef52f12118449be8e7abf37ba831b683f5067fa573af1f23cfd738f686
Opcode Fuzzy Hash: 87c7b66d50ccda618286ad69e76d28af360c7f1e4eff31c25162b23907185d18
Instruction Fuzzy Hash: D02103B1500344DFDB05DF10D9C0F26BB65FB98318F24817DE90A0B256C336D956CBA2

Function 00CDD208 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602655551.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_cdd000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e39a44ec606fa2117192b560ea2a5c03a18197ecd6c72432babb3cf9de9743c
Instruction ID: e500eba433b2c1f4eeb8e6554b9b70670bf22743a017929f098fe1190f535fbf
Opcode Fuzzy Hash: 4e39a44ec606fa2117192b560ea2a5c03a18197ecd6c72432babb3cf9de9743c
Instruction Fuzzy Hash: BE21C271A04344DFDB04DF50D9C4B26BB65FB94314F24C5AEEA0A4B396C376DC46CA61

Function 00CCD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602610908.0000000000CCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ccd000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 0c4404d071442411d43269b56caed04efa21f0a6a0ff34a5b01b88728977fdd3
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: D811D3B6504240DFCB15CF10D9C4B56BF71FB94318F24C6ADD80A0B656C33AD956CBA1

Function 00CDD203 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1602655551.0000000000CDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_cdd000_systemware.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: 9ac89eb0c369e818a212b51777d7d72ef5bb2fcf5aa22a19c87e3ead85d4477a
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: E811DD75904284CFCB01CF50D5C4B15BBA1FB84314F28C6AADD0A4B796C33AD84ACB61

Non-executed Functions

Function 055951C0 Relevance: 6.1, APIs: 4, Instructions: 140threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05595266
GetCurrentThread.KERNEL32 ref: 055952A3
GetCurrentProcess.KERNEL32 ref: 055952E0
GetCurrentThreadId.KERNEL32 ref: 05595339

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ef73b4b8080c38fd6016b60d8b2ad092ee0d52d526ce59b821a87e98101854e0
Instruction ID: 65d549839fbe9d159fce376ffd0463685c576a32853f4f7413489ca106312bd1
Opcode Fuzzy Hash: ef73b4b8080c38fd6016b60d8b2ad092ee0d52d526ce59b821a87e98101854e0
Instruction Fuzzy Hash: 3B5198B09057498FDB05CFA9D948B9EBBF0FF48300F24849AE049A72A1DB789944CB65

Function 05594B44 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 05595266
GetCurrentThread.KERNEL32 ref: 055952A3
GetCurrentProcess.KERNEL32 ref: 055952E0
GetCurrentThreadId.KERNEL32 ref: 05595339

Memory Dump Source

Source File: 00000004.00000002.1616879550.0000000005590000.00000040.00000800.00020000.00000000.sdmp, Offset: 05590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5590000_systemware.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a62378bba717d3eff58dc8eb5f13620c6e8f74b51f75b0224acdbd69cd073f48
Instruction ID: 173c9191162c1d65df44679a868e42d2cd552449717510506e3e746c793ca7a4
Opcode Fuzzy Hash: a62378bba717d3eff58dc8eb5f13620c6e8f74b51f75b0224acdbd69cd073f48
Instruction Fuzzy Hash: CD5155B090170A8FDB04DFAAD548B9EFBF1FF88304F208459E409A73A0DB789944CB65

Analysis Process: intro.avi.exePID: 7824, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	44
Total number of Limit Nodes:	4

Executed Functions

Function 0103C610 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0103C69E
GetCurrentThread.KERNEL32 ref: 0103C6DB
GetCurrentProcess.KERNEL32 ref: 0103C718
GetCurrentThreadId.KERNEL32 ref: 0103C771

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 71f4dcd62b15c8539ea37902e9eba8bdcd83d2d840384d15e30c6d63adf32e45
Instruction ID: 281ff9288f546607888aaca7ce8c5f08e6db6b86cc30b25e5e6e3d79d86cc70c
Opcode Fuzzy Hash: 71f4dcd62b15c8539ea37902e9eba8bdcd83d2d840384d15e30c6d63adf32e45
Instruction Fuzzy Hash: 875188B49007498FEB14DFA9D948BDEBBF1EF88314F20849AD408B7390CB74A844CB65

Function 0103C620 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0103C69E
GetCurrentThread.KERNEL32 ref: 0103C6DB
GetCurrentProcess.KERNEL32 ref: 0103C718
GetCurrentThreadId.KERNEL32 ref: 0103C771

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 843cc152bf32c846fda726fc7561cd1f270af69a22003cef1da2333711b192c1
Instruction ID: 87dcaa008d47ed05272a227b8192373a8e4d06ef40977aaa6601c900abe61f4a
Opcode Fuzzy Hash: 843cc152bf32c846fda726fc7561cd1f270af69a22003cef1da2333711b192c1
Instruction Fuzzy Hash: 905179B49007498FEB14DFAAD948B9EBBF1FF88304F20845AD409B7390DB74A944CB65

Function 01033334 Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010333F1

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 20c9d43a502798775180d6b1eaf70a89e76d62f5bed877184648a85d20180374
Instruction ID: ba51d35dfa6347789fa745ded77176d6ee61dc188d99f69b1650406b06e2e6d8
Opcode Fuzzy Hash: 20c9d43a502798775180d6b1eaf70a89e76d62f5bed877184648a85d20180374
Instruction Fuzzy Hash: 5941D2B4C007598BEB25CFA9C8847DEFBF5BB89304F20806AD448AB251DB756946CF90

Function 01031978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 010333F1

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1f99b244077d265d699230386293a28ba1b96e7f15a444909cedafa43ec119b0
Instruction ID: 8d10af9ca16756415c557609bc0c77fe95bc93a6866e71f01ae3a054bbd46527
Opcode Fuzzy Hash: 1f99b244077d265d699230386293a28ba1b96e7f15a444909cedafa43ec119b0
Instruction Fuzzy Hash: C941E0B4C00719CBEB24DFA9C884B9EFBF5BF89304F20806AD448AB251DB756945CF90

Function 0103C861 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0103C8EF

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ad69220215980c9eedc09a1200347e3ebd3862256603a15449c49e1dcfebaf89
Instruction ID: c09ba16509d3d0df0a3f97e029c70a60fb3f3eb910ee387f7191adbe03566fc4
Opcode Fuzzy Hash: ad69220215980c9eedc09a1200347e3ebd3862256603a15449c49e1dcfebaf89
Instruction Fuzzy Hash: 0221E4B5D002499FDB10CFAAD584ADEBBF4FB48320F14802AE958B7350D378A955CFA5

Function 0103C868 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0103C8EF

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 149ebcebd10dbd2d6b04e78a6b45c39fb1c0933f73312b23febc38865a4822e3
Instruction ID: ea924feabd0668a5a128666efe1f73697e90077008edac667e0c915675f4e9c9
Opcode Fuzzy Hash: 149ebcebd10dbd2d6b04e78a6b45c39fb1c0933f73312b23febc38865a4822e3
Instruction Fuzzy Hash: 0821E4B5D002499FDB10CF9AD584ADEBBF8FB48310F14801AE954B3350D374A950CFA5

Function 0103C588 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0103D2DD

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8b2381bea24a7d316f92d5264dadb8294d44816b2ea8a7fcd0e149c6f7b48c3e
Instruction ID: e60bde5f0299b702c6d9c79d69638afd2dc96356034ab0ae5e8093d0943d2d18
Opcode Fuzzy Hash: 8b2381bea24a7d316f92d5264dadb8294d44816b2ea8a7fcd0e149c6f7b48c3e
Instruction Fuzzy Hash: B41112B5C003498FDB20DF9AD444BDEFBF8EB88220F20845AD558A7740D378A944CFA5

Function 0103D280 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0103D2DD

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 27ff809ad2cc81d9558b14c58ec75e1bab2c60ac30f07303fb56c2b0066dab7d
Instruction ID: 3f034e4c10a7aaf523db4c8eb925a56b9b09dcfb0e4df798afe163487149e5af
Opcode Fuzzy Hash: 27ff809ad2cc81d9558b14c58ec75e1bab2c60ac30f07303fb56c2b0066dab7d
Instruction Fuzzy Hash: 811142B4C003498FDB20CFAAD445BCEBBF8EB48320F20845AD558A3700C378A940CFA5

Function 0103E6E8 Relevance: 1.3, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 0103E748

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d95738a33ab93e62d4e998d1a73f33d7df0d1b8aeb36cf587b85aeb36062368e
Instruction ID: c6f589606ed7e5b3cd7cba5852123d3826ca6e408087da09afbbd307c984e2ef
Opcode Fuzzy Hash: d95738a33ab93e62d4e998d1a73f33d7df0d1b8aeb36cf587b85aeb36062368e
Instruction Fuzzy Hash: 001125B58003498FDB20DF9AD445BDEBBF4EB48320F20846AD558A7240D379A545CFA5

Function 0103E6F0 Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?), ref: 0103E748

Memory Dump Source

Source File: 00000007.00000002.1428559530.0000000001030000.00000040.00000800.00020000.00000000.sdmp, Offset: 01030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1030000_intro.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b057fdaf9942939ce61513dda92a1963945ba59260ac69d7278943e4e0bd9495
Instruction ID: 53dee3acd43116c648033295408d286266fb6e70b1ad0fd59e2b6ab3156ab159
Opcode Fuzzy Hash: b057fdaf9942939ce61513dda92a1963945ba59260ac69d7278943e4e0bd9495
Instruction Fuzzy Hash: A11145B5800349CFDB20CF9AC445BDEBBF4EB48320F10846AD558A7380D378A544CFA5

Function 00CBD4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1427035225.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cbd000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53884ac580f5719c03a22217e227b5e5b7620be70fabe7c2ec0a78c0e5c7181
Instruction ID: e03eb829efd4a2aa56c00a5a537105eec4a0cd7f2f7d626d0becfa79dc2251ee
Opcode Fuzzy Hash: f53884ac580f5719c03a22217e227b5e5b7620be70fabe7c2ec0a78c0e5c7181
Instruction Fuzzy Hash: 7E2137B1500344DFDB25DF10D9C0B66BB65FB98318F248169E80B0B256D336D95ACBA2

Function 00CBD4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1427035225.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_cbd000_intro.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 0999fbeb250e50289b040cef4f887e8437c4bad383756b7658888747ec1223a7
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 5D11E6B6504240CFCF15CF10D5C4B56BF71FB94318F24C6A9D80A0B656C33AD95ACBA2

Analysis Process: systemware.exePID: 7312, Parent PID: 7904COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	41
Total number of Limit Nodes:	3

Executed Functions

Function 0557C610 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0557C69E
GetCurrentThread.KERNEL32 ref: 0557C6DB
GetCurrentProcess.KERNEL32 ref: 0557C718
GetCurrentThreadId.KERNEL32 ref: 0557C771

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f8c0a62b8e5eb7d8495377ace1c4d88b59ac0a85abfd976dfeb43ff2821c3f59
Instruction ID: 11acb3ca4f5622d142713b1a917c2a5675efd1f5be4ebc3ea0a0711e9311f1c0
Opcode Fuzzy Hash: f8c0a62b8e5eb7d8495377ace1c4d88b59ac0a85abfd976dfeb43ff2821c3f59
Instruction Fuzzy Hash: F35145B09107498FDB14CFAAD588B9EBBF1FF48304F24809EE409AB290DB749944CF65

Function 0557C620 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0557C69E
GetCurrentThread.KERNEL32 ref: 0557C6DB
GetCurrentProcess.KERNEL32 ref: 0557C718
GetCurrentThreadId.KERNEL32 ref: 0557C771

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a0f2da8ab4382361cf7168954d903e7a2c5a93631a4d2cdea79f5b8d9df3bcb7
Instruction ID: 5981e32ee656d4306ef7def6df9327f83fac125057c3bb51ef15165a4d7363c9
Opcode Fuzzy Hash: a0f2da8ab4382361cf7168954d903e7a2c5a93631a4d2cdea79f5b8d9df3bcb7
Instruction Fuzzy Hash: 0A5134B0D106498FDB18CFAAD548B9EBBF1BF88314F24809EE409A7390DB749944CF65

Function 05573334 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 055733F1

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2ad0db2b39539b0a232fe6cb3e4f0f2e4e92e8238c35d83308ecdeb671135d98
Instruction ID: ce0e945575417d91574618d3e444737194872c8539c7003e672db14cab2f5612
Opcode Fuzzy Hash: 2ad0db2b39539b0a232fe6cb3e4f0f2e4e92e8238c35d83308ecdeb671135d98
Instruction Fuzzy Hash: FA41FFB0C00719CBDB24CFA9D848BDEBBB2BF48304F20846AC008AB250DB755946CF90

Function 05571978 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 055733F1

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 539f160644549b66f63c368235080c54108c9d351db74aaf4aff139fcd2d6a55
Instruction ID: 4e8a7a3456fb51971134bc73e67866baeb278af015a49dbbe073fe800d93c360
Opcode Fuzzy Hash: 539f160644549b66f63c368235080c54108c9d351db74aaf4aff139fcd2d6a55
Instruction Fuzzy Hash: DF41DFB0C0075DCBDB24CFA9D848B9EBBB6FF49314F20846AD408AB251DB756946CF90

Function 0557C861 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0557C8EF

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 651cac70527d8b68a3d5244330a92ec3e9ee4f39ee04255608e342293be7d23a
Instruction ID: 62e35fbc25cea1bd9e9cd6fb40013a1e7f19fcbbfce96c0a3a9fcbdb901c393c
Opcode Fuzzy Hash: 651cac70527d8b68a3d5244330a92ec3e9ee4f39ee04255608e342293be7d23a
Instruction Fuzzy Hash: C821E3B5D00349AFDB10CFAAD584ADEBBF8FB48310F14801AE914A3350D378A950CF64

Function 0557C868 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0557C8EF

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 032269236e9ef39bdfa7a513e33e75b3b7e44fa361f201a0300edb5671dbf727
Instruction ID: 7a36c411fa86ef7172a1c6114905483183e9b98ade6e322da6e2134274af2f1b
Opcode Fuzzy Hash: 032269236e9ef39bdfa7a513e33e75b3b7e44fa361f201a0300edb5671dbf727
Instruction Fuzzy Hash: 2521C4B5D00249AFDB10CF9AD584ADEBBF9FB48310F14841AE914A3350D374A954CF65

Function 0557C588 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0557D2DD

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 71489fe3ec3aa436389768db2f1f137a2eca8be8ca9174bcf348508016e43c71
Instruction ID: 0dc80077d1a23eff581f6e0184c49e1cdc58b765691123dcfa543382e734efd3
Opcode Fuzzy Hash: 71489fe3ec3aa436389768db2f1f137a2eca8be8ca9174bcf348508016e43c71
Instruction Fuzzy Hash: C01100B5C043498FDB20DF9AE448BDEFBF8FB48224F20845AD519A7600D778A944CFA5

Function 0557D280 Relevance: 1.5, APIs: 1, Instructions: 45
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 0557D2DD

Memory Dump Source

Source File: 00000010.00000002.1517942593.0000000005570000.00000040.00000800.00020000.00000000.sdmp, Offset: 05570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5570000_systemware.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 40dfa55c849a9dfc952235c54debb0016ea578e03b65983c3b0289866d4b8749
Instruction ID: ca1a6cdf9964cc735e2d00b64c02a6117fc2438da198aa389a1035de48e6fa91
Opcode Fuzzy Hash: 40dfa55c849a9dfc952235c54debb0016ea578e03b65983c3b0289866d4b8749
Instruction Fuzzy Hash: D61130B5C003498FDB10CFA9D549BCEBBF4AB08220F20841AD018B3600D378A640CFA0

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report intro.avi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_systemware.exe_86b7df83af42ea155ac2e3f11958857a6c94c44_bafed569_be9eab76-eab3-4d90-b748-c14825b13afb\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER24CC.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER26E0.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2720.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\intro.avi.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\systemware.exe.log

C:\Users\user\AppData\Local\Temp\7jSSwThVwFwB.bat

C:\Users\user\AppData\Roaming\logs\01-02-2025

C:\Users\user\AppData\Roaming\system\systemware.exe

C:\Windows\appcompat\Programs\Amcache.hve

Windows Analysis Report
intro.avi.exe