Windows Analysis Report
agHzhs8gQd.exe

Overview

General Information

Sample name: agHzhs8gQd.exe
renamed because original name is a hash value
Original sample name: b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477.exe
Analysis ID: 1614214
MD5: c836c14219ca56536439cc008608740f
SHA1: a4e237dbd668e757595084872a921746edbcd418
SHA256: b94ecfae3b5514ba1dc5c10faf595527159a535b5c326b39cb42185e6ef6d477
Tags: 146-19-207-4exeuser-JAMESWT_MHT
Infos:

Detection

Amadey
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey
Yara detected Amadeys stealer DLL
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to detect virtual machines (IN, VMware)
Found hidden mapped module (file has been removed from disk)
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Sample uses string decryption to hide its real strings
Switches to a custom stack to bypass stack traces
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to get notified if a device is plugged in / out
Contains functionality to launch a process as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Execution From GUID Like Folder Names
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: agHzhs8gQd.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk Avira: detection malicious, Label: TR/Redcap.uaenj
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Avira: detection malicious, Label: TR/Redcap.jcapt
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\intl.dll Avira: detection malicious, Label: TR/HijackLoader.iogpz
Found malware configuration
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Amadey {"C2 url": "kataraus.info/mbSDvj3/index.php", "Version": "4.02", "Install Folder": "1743fda81d", "Install File": "Utsysc.exe"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk ReversingLabs: Detection: 72%
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\intl.dll ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe ReversingLabs: Detection: 40%
Multi AV Scanner detection for submitted file
Source: agHzhs8gQd.exe Virustotal: Detection: 55% Perma Link
Source: agHzhs8gQd.exe ReversingLabs: Detection: 40%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: kataraus.info
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: /mbSDvj3/index.php
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: S-%lu-
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: 1743fda81d
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Utsysc.exe
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SCHTASKS
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: /TR "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Startup
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: /Delete /TN "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Programs
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: %USERPROFILE%
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: http://
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: https://
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Plugins/
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: &unit=
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: shell32.dll
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: kernel32.dll
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: GetNativeSystemInfo
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProgramData\
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: AVAST Software
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Kaspersky Lab
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Panda Security
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Doctor Web
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: 360TotalSecurity
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Bitdefender
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Norton
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Sophos
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Comodo
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: WinDefender
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: 0123456789
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: ------
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: ?scr=1
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: ComputerName
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: -unicode-
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: VideoID
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: ProductName
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: CurrentBuild
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: echo Y|CACLS "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: " /P "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: CACLS "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: :R" /E
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: :F" /E
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: &&Exit
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: rundll32.exe
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: "taskkill /f /im "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && timeout 1 && del
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: && Exit"
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: " && ren
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: Powershell.exe
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: shutdown -s -t 0
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp String decryptor: X}f|"D
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7F2FC0 Random_Crypto,Panic,Hostinfo_GetTimeOfDay,VMW_SHA1Init,VMW_SHA1Update,VMW_SHA1Update,VMW_SHA1Update,VMW_SHA1Final, 3_2_6C7F2FC0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C6A20 CryptAcquireContextA,GetLastError,Log,CryptGenRandom,GetLastError,Log,CryptReleaseContext,CryptReleaseContext,GetLastError,Log,Random_Crypto, 3_2_6C7C6A20
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FF2D0 CryptoHash_FromString,Panic,HashTable_AllocOnce,HashTable_ReplaceOrInsert,free, 3_2_6C7FF2D0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FF2B0 CryptoHash_GetOutputSize,Panic,CryptoHash_FromString,Panic,HashTable_AllocOnce,HashTable_ReplaceOrInsert,free, 3_2_6C7FF2B0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FF290 CryptoHash_Compute,Panic,CryptoHash_GetOutputSize,Panic,CryptoHash_FromString,Panic,HashTable_AllocOnce,HashTable_ReplaceOrInsert,free, 3_2_6C7FF290
Uses 32bit PE files
Source: agHzhs8gQd.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\LicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\LicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll Jump to behavior
Source: agHzhs8gQd.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: c:\toolchain\src\libiconv-1.9.2\libiconv-1.9.2\windows\vc90\Win32\Release\dll\iconv.pdb source: vmtoolsd.exe, 00000003.00000002.2189840391.000000001010D000.00000002.00000001.01000000.00000010.sdmp, iconv.dll.2.dr
Source: Binary string: useractivitybroker.pdbGCTL source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365976757.00000000003BD000.00000008.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gmodule-2.0.pdbu source: vmtoolsd.exe, 00000003.00000002.2191543903.000000006EAF3000.00000002.00000001.01000000.0000000C.sdmp, gmodule-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gthread-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191426192.000000006E554000.00000002.00000001.01000000.0000000E.sdmp, gthread-2.0.dll.2.dr
Source: Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365880709.00000000003A6000.00000002.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb source: agHzhs8gQd.exe, _is7F4B.exe.0.dr
Source: Binary string: useractivitybroker.pdb source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365976757.00000000003BD000.00000008.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\glib-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191072215.000000006C965000.00000002.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gobject-2.0.pdbe} source: vmtoolsd.exe, 00000003.00000002.2190762975.000000006C878000.00000002.00000001.01000000.0000000D.sdmp, gobject-2.0.dll.2.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb+ source: vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdbK source: agHzhs8gQd.exe, _is7F4B.exe.0.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb source: vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr
Source: Binary string: wntdll.pdbUGP source: vmtoolsd.exe, 00000003.00000002.2189493372.00000000032DE000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390174035.000000000532E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390462106.0000000005770000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367571436.000000000493B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367751694.0000000004C90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\toolchain\src\gettext-0.14.6-2\gettext-0.14.6\gettext-runtime\windows\vc90\Release\bin\intl.pdb source: vmtoolsd.exe, 00000003.00000002.2191305330.000000006DE80000.00000002.00000001.01000000.0000000A.sdmp, intl.dll.2.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\services\vmtoolsd\vmtoolsd.pdb source: vmtoolsd.exe, 00000003.00000000.2135073330.0000000000AD7000.00000002.00000001.01000000.00000009.sdmp, vmtoolsd.exe, 00000003.00000002.2188801509.0000000000AD7000.00000002.00000001.01000000.00000009.sdmp, vmtoolsd.exe.2.dr
Source: Binary string: wntdll.pdb source: vmtoolsd.exe, 00000003.00000002.2189493372.00000000032DE000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390174035.000000000532E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390462106.0000000005770000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367571436.000000000493B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367751694.0000000004C90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gobject-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2190762975.000000006C878000.00000002.00000001.01000000.0000000D.sdmp, gobject-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gthread-2.0.pdb% source: vmtoolsd.exe, 00000003.00000002.2191426192.000000006E554000.00000002.00000001.01000000.0000000E.sdmp, gthread-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gmodule-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191543903.000000006EAF3000.00000002.00000001.01000000.0000000C.sdmp, gmodule-2.0.dll.2.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\Setup_UI.pdb source: Setup_UI.dll.2.dr
Contains functionality to get notified if a device is plugged in / out
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD58B0 RegisterDeviceNotificationW, 3_2_00AD58B0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107F504 FindFirstFileExW, 0_2_0107F504
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FDFE90 FindFirstFileW,__CxxThrowException@8,FindClose, 0_2_00FDFE90
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB71CB __EH_prolog3_GS,GetModuleHandleW,GetModuleHandleW,GetProcAddress,FindFirstFileW,GetModuleHandleW,GetProcAddress, 2_2_00AB71CB
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00ACF504 FindFirstFileExW, 2_2_00ACF504
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A2FE90 FindFirstFileW,__CxxThrowException@8,FindClose, 2_2_00A2FE90
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C4E50 strchr,Log,Unicode_GetAllocBytes,UtilSafeMalloc0,wcscspn,wcschr,wcschr,wcschr,wcschr,UtilSafeRealloc0,memcpy,towupper,wcscspn,UtilSafeRealloc0,memcpy,FindFirstFileW,FindClose,wcsspn,UtilSafeRealloc0,memcpy,Unicode_AllocWithLength,free,free,free,free, 3_2_6C7C4E50
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7BBEC0 Unicode_GetAllocBytes,free,FindFirstFileW,GetLastError,free,Err_Errno2String,Log,Err_Errno2String,Log, 3_2_6C7BBEC0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C4FB8 wcscspn,UtilSafeRealloc0,memcpy,FindFirstFileW,FindClose,wcsspn,UtilSafeRealloc0,memcpy,Unicode_AllocWithLength,free,free,free,free, 3_2_6C7C4FB8
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7BABE0 Str_Asprintf,Warning,Win32U_FindFirstFileW,free,Str_Asprintf,free,FindNextFileW,Warning,FindClose, 3_2_6C7BABE0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C21C0 Win32U_FindFirstFileW,Unicode_GetAllocBytes,FindFirstFileW,free, 3_2_6C7C21C0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7F3600 WiperPartition_Open,Panic,Win32U_GetLogicalDriveStrings,GetLastError,Log,free,free,free, 3_2_6C7F3600

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: kataraus.info/mbSDvj3/index.php
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: kataraus.info replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7B4CE0 recv,WSAGetLastError,Err_Errno2String,Warning,Debug,Debug, 3_2_6C7B4CE0
Source: global traffic DNS traffic detected: DNS query: kataraus.info
Source: vmtoolsd.exe, 00000003.00000002.2189324197.000000000311F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://c0rl.m%L
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: glib-2.0.dll.2.dr String found in binary or memory: http://freedesktop.org
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://freedesktop.orgmetadataUnexpected
Source: explorer.exe, 00000009.00000003.3287156807.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.#;p
Source: explorer.exe, 00000009.00000003.3204418097.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.&T
Source: explorer.exe, 00000009.00000003.3174711250.00000000008DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.7
Source: explorer.exe, 00000009.00000003.3359463454.00000000008F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.:n
Source: explorer.exe, 00000009.00000003.3218136592.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info
Source: explorer.exe, 00000009.00000003.3258828239.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3330582235.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3132497975.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3359698304.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3206533355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3208788355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3359463454.00000000008F6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3354297313.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3209576839.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3209648472.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3174711250.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3259586789.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3260429837.00000000008F1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS
Source: explorer.exe, 00000009.00000003.3215962268.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3215337216.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3214431469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3214593761.00000000008EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS#Xh
Source: explorer.exe, 00000009.00000003.3178617313.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS(
Source: explorer.exe, 00000009.00000003.3132497975.00000000008D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS2
Source: explorer.exe, 00000009.00000003.3287156807.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS5;b
Source: explorer.exe, 00000009.00000003.3331326152.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS6Gb
Source: explorer.exe, 00000009.00000003.3273375088.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbS;Ub
Source: explorer.exe, 00000009.00000003.3336080047.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3221944798.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3300929834.000000000089C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3222385479.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3
Source: explorer.exe, 00000009.00000003.3174711250.00000000008DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/ind
Source: explorer.exe, 00000009.00000003.3330582235.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3331326152.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/ind(
Source: explorer.exe, 00000009.00000003.3208788355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3177367154.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3271467590.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.p
Source: explorer.exe, 00000009.00000003.3273375088.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3131199577.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3274416057.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3334028995.0000000000919000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3214593761.00000000008EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php
Source: explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php%
Source: explorer.exe, 00000009.00000003.3116976956.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php&
Source: explorer.exe, 00000009.00000003.3120536170.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php-Cv
Source: explorer.exe, 00000009.00000003.3300929834.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php044F36178EDCAC3F2B5156A61157B94B76E032CC1B
Source: explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php091B166991FFDDFB7DCB630485
Source: explorer.exe, 00000009.00000003.3268562083.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3268209847.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php0u0u
Source: explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php0u0u0u0u
Source: explorer.exe, 00000009.00000003.3273375088.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php25A71A87A30C0A46282704C5044F36178EDCAC3F2B
Source: explorer.exe, 00000009.00000003.3333767878.00000000008E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php2hh
Source: explorer.exe, 00000009.00000003.3216094100.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3216024777.00000000008DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php3
Source: explorer.exe, 00000009.00000003.3121898397.00000000008FD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php5
Source: explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php7
Source: explorer.exe, 00000009.00000003.3359698304.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3359463454.00000000008F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php76
Source: explorer.exe, 00000009.00000003.3273375088.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php7DCB630485CBDB629D2BF4599BCCAAC1DF
Source: explorer.exe, 00000009.00000003.3268562083.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3268209847.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php7GV
Source: explorer.exe, 00000009.00000003.3300929834.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php85CBDB629D2BF4599B
Source: explorer.exe, 00000009.00000003.3330582235.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php:
Source: explorer.exe, 00000009.00000003.3221528603.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php=
Source: explorer.exe, 00000009.00000003.3160660801.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3162055219.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php?I
Source: explorer.exe, 00000009.00000003.3206533355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpAm8
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpB
Source: explorer.exe, 00000009.00000003.3333767878.00000000008E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpBh
Source: explorer.exe, 00000009.00000003.3162055219.00000000008DD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpE
Source: explorer.exe, 00000009.00000003.3160660801.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3178617313.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3177367154.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3174711250.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3175811531.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpF
Source: explorer.exe, 00000009.00000003.3131199577.00000000008D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpF$
Source: explorer.exe, 00000009.00000003.3336080047.00000000008EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpGo
Source: explorer.exe, 00000009.00000003.3331326152.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpJ
Source: explorer.exe, 00000009.00000003.3334028995.000000000091E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpK
Source: explorer.exe, 00000009.00000003.3218773710.00000000008DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpM
Source: explorer.exe, 00000009.00000003.3274495409.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3274416057.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpPc6
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpQ7f
Source: explorer.exe, 00000009.00000003.3274495409.00000000008EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3274416057.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpSY
Source: explorer.exe, 00000009.00000003.3336080047.00000000008EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpTh
Source: explorer.exe, 00000009.00000003.3268562083.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3268209847.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpWU
Source: explorer.exe, 00000009.00000003.3334028995.000000000091E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpY
Source: explorer.exe, 00000009.00000003.3121898397.00000000008FD000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.php_x-
Source: explorer.exe, 00000009.00000003.3160660801.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3145351878.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3162055219.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3132373581.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3131199577.00000000008D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpa
Source: explorer.exe, 00000009.00000003.3216739904.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3216609939.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3217231959.00000000008F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpaus.infP
Source: explorer.exe, 00000009.00000003.3336080047.00000000008EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpdh:
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpe7j
Source: explorer.exe, 00000009.00000003.3131199577.00000000008D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpet
Source: explorer.exe, 00000009.00000003.3132497975.00000000008D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3287156807.0000000000918000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpf
Source: explorer.exe, 00000009.00000003.3287156807.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpi;6
Source: explorer.exe, 00000009.00000003.3330582235.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpjG6
Source: explorer.exe, 00000009.00000003.3206533355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3216739904.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3216609939.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3217231959.00000000008F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpka
Source: explorer.exe, 00000009.00000003.2598670131.00000000008D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpkataraus.info
Source: explorer.exe, 00000009.00000003.3175811531.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpkataraus.info5
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3300929834.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpl
Source: explorer.exe, 00000009.00000003.3132373581.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phplA6
Source: explorer.exe, 00000009.00000003.3221944798.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3221528603.00000000008DC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3222385479.00000000008DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpm=6
Source: explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpoU8
Source: explorer.exe, 00000009.00000003.3333767878.00000000008E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpon
Source: explorer.exe, 00000009.00000003.3218773710.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3219575151.00000000008E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpp
Source: explorer.exe, 00000009.00000003.3216094100.00000000008E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3216024777.00000000008DB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpqG
Source: explorer.exe, 00000009.00000003.3209576839.00000000008E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpqM
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3300929834.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpr
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phprasadhlp.dllx
Source: explorer.exe, 00000009.00000003.3268562083.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3333767878.00000000008E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpuo
Source: explorer.exe, 00000009.00000003.3356712486.0000000000918000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpw
Source: explorer.exe, 00000009.00000002.3366133731.00000000008B4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpx
Source: explorer.exe, 00000009.00000003.3287156807.0000000000918000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpxy
Source: explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpy7
Source: explorer.exe, 00000009.00000003.3349334097.00000000008EA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3350095455.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3/index.phpzoRs6
Source: explorer.exe, 00000009.00000003.3221944798.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3222385479.00000000008DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj38
Source: explorer.exe, 00000009.00000003.3206914319.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3Zm%
Source: explorer.exe, 00000009.00000003.3208788355.00000000008EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3hU%
Source: explorer.exe, 00000009.00000003.3221944798.00000000008DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3222385479.00000000008DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSDvj3x=%
Source: explorer.exe, 00000009.00000003.3331326152.00000000008E1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSFG
Source: explorer.exe, 00000009.00000003.3121898397.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSIC
Source: explorer.exe, 00000009.00000003.3273375088.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSKU
Source: explorer.exe, 00000009.00000003.3354297313.00000000008E9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSMi
Source: explorer.exe, 00000009.00000003.3214431469.00000000008E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.3214593761.00000000008EC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.info/mbSS_8
Source: explorer.exe, 00000009.00000003.3287156807.00000000008DC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://kataraus.infoR;
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, vmtoolsd.exe, 00000003.00000002.2189324197.000000000311F000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, agHzhs8gQd.exe, _is7F4B.exe.0.dr, Setup_UI.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0L
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://ocsp.thawte.com0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://s2.symcb.com0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://sv.symcd.com0&
Source: gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Setup_UI.dll.2.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Setup_UI.dll.2.dr String found in binary or memory: http://www.flexerasoftware.com0
Source: glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarks
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksapplicationUnexpected
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksgroupUnexpected
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksgrouphttp://www.freedesktop.org/standards/desk
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksgroupshttp://www.freedesktop.org/standards/des
Source: vmtoolsd.exe, 00000003.00000002.2191190874.000000006C974000.00000008.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/desktop-bookmarksmetadataUnexpected
Source: glib-2.0.dll.2.dr String found in binary or memory: http://www.freedesktop.org/standards/shared-mime-info
Source: vmtoolsd.exe, 00000003.00000002.2189393361.00000000031D7000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.0000000005684000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B53000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.info-zip.org/
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://www.symauth.com/cps0(
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, vmtoolsd.exe, 00000003.00000002.2189324197.000000000311F000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: http://www.symauth.com/rpa00
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, gmodule-2.0.dll.2.dr, vmtools.dll.2.dr, iconv.dll.2.dr, glib-2.0.dll.2.dr, gthread-2.0.dll.2.dr, vmtoolsd.exe.2.dr, gobject-2.0.dll.2.dr, intl.dll.2.dr String found in binary or memory: http://www.vmware.com/0
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.vmware.com/0/
Source: vmtoolsd.exe, vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr String found in binary or memory: http://www.vmware.com/info?id=99
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: https://d.symcb.com/cps0%
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, Setup_UI.dll.2.dr String found in binary or memory: https://d.symcb.com/rpa0
Source: agHzhs8gQd.exe, _is7F4B.exe.0.dr String found in binary or memory: https://winscp.net/eng/docs/installation0
Source: vmtoolsd.exe, 00000003.00000002.2189324197.000000000311F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.digicert.com/CP
Source: vmtoolsd.exe, 00000003.00000002.2189393361.000000000322D000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390348510.00000000056CC000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp, agHzhs8gQd.exe, _is7F4B.exe.0.dr, Setup_UI.dll.2.dr String found in binary or memory: https://www.digicert.com/CPS0

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.2.explorer.exe.370000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 4.2.netsh.exe.5c700c8.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 4.2.netsh.exe.5c700c8.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000009.00000002.3365824204.0000000000371000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk, type: DROPPED Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C804CD0: DeviceIoControl,DeviceIoControl,FlushFileBuffers,DeviceIoControl,GetLastError,Debug,GetLastError,Debug, 3_2_6C804CD0
Contains functionality to delete services
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD5190 OpenSCManagerW,OpenServiceW,DeleteService,CloseServiceHandle,CloseServiceHandle, 3_2_00AD5190
Contains functionality to launch a process as a different user
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C804410 ProcMgr_ExecSync,Panic,Panic,Debug,memset,Panic,CodeSet_Utf8ToUtf16le,Warning,CreateProcessW,CreateProcessAsUserW,SetProcessWindowStation,GetLastError,Warning,Debug,WaitForSingleObject,GetExitCodeProcess,free,CloseHandle,CloseHandle,CloseHandle, 3_2_6C804410
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0106935F GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 0_2_0106935F
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB935F GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 2_2_00AB935F
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FBEA0 System_Shutdown,Hostinfo_GetOSType,System_SetProcessPrivilege,InitiateSystemShutdownW,InitiateSystemShutdownW,InitiateSystemShutdownW,GetLastError,ExitWindowsEx,ExitWindowsEx, 3_2_6C7FBEA0
Detected potential crypto function
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107479A 0_2_0107479A
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01080BB0 0_2_01080BB0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01074C96 0_2_01074C96
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107916B 0_2_0107916B
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0108105E 0_2_0108105E
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010750AE 0_2_010750AE
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010253C0 0_2_010253C0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010615B0 0_2_010615B0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010855C4 0_2_010855C4
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010754E3 0_2_010754E3
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01075918 0_2_01075918
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FD5880 0_2_00FD5880
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01021B90 0_2_01021B90
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01061D70 0_2_01061D70
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01025C90 0_2_01025C90
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01075E98 0_2_01075E98
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010621E0 0_2_010621E0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0102E390 0_2_0102E390
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01062610 0_2_01062610
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FE2820 0_2_00FE2820
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0106EDB8 0_2_0106EDB8
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01062FF0 0_2_01062FF0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0105F190 0_2_0105F190
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01043070 0_2_01043070
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0105F96D 0_2_0105F96D
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0105FBC3 0_2_0105FBC3
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FEBB00 0_2_00FEBB00
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AAF190 2_2_00AAF190
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A3BB00 2_2_00A3BB00
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC479A 2_2_00AC479A
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AD0BB0 2_2_00AD0BB0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC4C96 2_2_00AC4C96
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC50AE 2_2_00AC50AE
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AD105E 2_2_00AD105E
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC916B 2_2_00AC916B
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A753C0 2_2_00A753C0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC54E3 2_2_00AC54E3
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB15B0 2_2_00AB15B0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AD55C4 2_2_00AD55C4
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A25880 2_2_00A25880
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC5918 2_2_00AC5918
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A71B90 2_2_00A71B90
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A75C90 2_2_00A75C90
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB1D70 2_2_00AB1D70
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC5E98 2_2_00AC5E98
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB21E0 2_2_00AB21E0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A7E390 2_2_00A7E390
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB2610 2_2_00AB2610
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A32820 2_2_00A32820
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00ABEDB8 2_2_00ABEDB8
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB2FF0 2_2_00AB2FF0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A93070 2_2_00A93070
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AAF96D 2_2_00AAF96D
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AAFBC3 2_2_00AAFBC3
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_10002C30 3_2_10002C30
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_1010F070 3_2_1010F070
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_100121B0 3_2_100121B0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_1000AA60 3_2_1000AA60
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_100013A0 3_2_100013A0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7E1C50 3_2_6C7E1C50
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C801F50 3_2_6C801F50
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FFFA0 3_2_6C7FFFA0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7EAAE0 3_2_6C7EAAE0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7DFB50 3_2_6C7DFB50
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7DCBD0 3_2_6C7DCBD0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7E4BB0 3_2_6C7E4BB0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FDBB0 3_2_6C7FDBB0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7E2570 3_2_6C7E2570
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7CA600 3_2_6C7CA600
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7E5600 3_2_6C7E5600
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7DD6F0 3_2_6C7DD6F0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7E8000 3_2_6C7E8000
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7CF090 3_2_6C7CF090
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7EA140 3_2_6C7EA140
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C805160 3_2_6C805160
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7D321A 3_2_6C7D321A
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7F4390 3_2_6C7F4390
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\glib-2.0.dll 030983470DA06708CC55FD6ACA92DF199A051922B580DB5DB55C8CB6B203B51B
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00AC1F00 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00A2E110 appears 144 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00AC185E appears 45 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00AC0EC5 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00A26DD0 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00A26CE0 appears 110 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00A2B3B0 appears 341 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00A24190 appears 297 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00AB48E9 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: String function: 00AC182A appears 51 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 00FD4190 appears 297 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 010648E9 appears 70 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 0107182A appears 51 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 00FDB3B0 appears 341 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 00FD6CE0 appears 110 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 0107185E appears 45 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 01070EC5 appears 36 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 00FD6DD0 appears 82 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 00FDE110 appears 144 times
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: String function: 01071F00 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7B3560 appears 179 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7B3450 appears 265 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7CDA40 appears 142 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7CDAC0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 00AD1000 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7FCF70 appears 79 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7B30E0 appears 147 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C800CD0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: String function: 6C7B3410 appears 243 times
PE / OLE file has an invalid certificate
Source: agHzhs8gQd.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: agHzhs8gQd.exe, 00000000.00000002.2195500945.0000000001103000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameSetup.exeJ vs agHzhs8gQd.exe
Source: agHzhs8gQd.exe, 00000000.00000002.2195500945.0000000001103000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameInstallShield SetupSuite.exe< vs agHzhs8gQd.exe
Source: agHzhs8gQd.exe Binary or memory string: OriginalFilenameSetup.exeJ vs agHzhs8gQd.exe
Source: agHzhs8gQd.exe Binary or memory string: OriginalFilenameInstallShield SetupSuite.exe< vs agHzhs8gQd.exe
Uses 32bit PE files
Source: agHzhs8gQd.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 9.2.explorer.exe.370000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 4.2.netsh.exe.5c700c8.7.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 4.2.netsh.exe.5c700c8.7.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000009.00000002.3365824204.0000000000371000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk, type: DROPPED Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: vmtools.dll.2.dr Binary string: \Device\Harddisk
Source: vmtools.dll.2.dr Binary string: %swiper%derror.unmap\\?\%s\Device\HarddiskBus Type for %s is 0x%x
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@13/93@20/0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0106935F GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 0_2_0106935F
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB935F GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx, 2_2_00AB935F
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FC0A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,GetLastError,Err_Errno2String,Str_Asprintf,Warning, 3_2_6C7FC0A0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FB390 System_SetProcessPrivilege,GetCurrentProcess,OpenProcessToken,GetLastError,Debug,LookupPrivilegeValueW,GetLastError,GetLastError,Debug,AdjustTokenPrivileges,GetLastError,GetLastError,Debug,CloseHandle,GetLastError,Debug, 3_2_6C7FB390
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C2670 Unicode_GetAllocBytes,GetDiskFreeSpaceW,free, 3_2_6C7C2670
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: OpenSCManagerW,GetModuleFileNameW,Str_Aswprintf,Str_Aswprintf,Panic,CreateServiceW,free,CloseServiceHandle,Str_Snwprintf,RegCreateKeyW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,RegSetValueExW,RegSetValueExW,RegSetValueExW,RegCloseKey,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 3_2_00AD5B20
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010105B0 CoCreateInstance, 0_2_010105B0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD5E80 StartServiceCtrlDispatcherW,GetLastError,SetEvent, 3_2_00AD5E80
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD5E80 StartServiceCtrlDispatcherW,GetLastError,SetEvent, 3_2_00AD5E80
Source: C:\Windows\SysWOW64\netsh.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Mutant created: \Sessions\1\BaseNamedObjects\{047144DF-37CC-4421-930E-8F25AD640756}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1548:120:WilError_03
Source: C:\Windows\SysWOW64\explorer.exe Mutant created: \Sessions\1\BaseNamedObjects\9a9b42ef037916ec84b9b7b3ac05b288
Source: C:\Users\user\Desktop\agHzhs8gQd.exe File created: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3} Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: IS_temp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: runfromtemp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: kernel32.dll 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SuiteGUID 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SuiteSetup.ini 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SuiteSetup.ini 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: embedded: 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: IS_ProxyWaiter_ 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: debuglog 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: newlog 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SetupSuite.cpp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SetupSuite.cpp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SetupSuite.cpp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SetupSuite.cpp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SetupSuite.cpp 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SuiteSetup.ini 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: SuiteSetup.ini 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: clone_wait 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: debuglog 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: /debuglog 0_2_0100C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Command line argument: /debuglog 0_2_0100C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: IS_temp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: runfromtemp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: kernel32.dll 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SuiteGUID 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SuiteSetup.ini 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SuiteSetup.ini 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: embedded: 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: IS_ProxyWaiter_ 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: debuglog 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: newlog 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SetupSuite.cpp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SetupSuite.cpp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SetupSuite.cpp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SetupSuite.cpp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SetupSuite.cpp 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SuiteSetup.ini 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: SuiteSetup.ini 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: clone_wait 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: debuglog 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: /debuglog 2_2_00A5C1A0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Command line argument: /debuglog 2_2_00A5C1A0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe File read: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\SuiteSetup.ini Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: agHzhs8gQd.exe Virustotal: Detection: 55%
Source: agHzhs8gQd.exe ReversingLabs: Detection: 40%
Source: vmtoolsd.exe String found in binary or memory: --help
Source: vmtoolsd.exe String found in binary or memory: --help
Source: agHzhs8gQd.exe String found in binary or memory: (https://winscp.net/eng/docs/installation0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe File read: C:\Users\user\Desktop\agHzhs8gQd.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\agHzhs8gQd.exe "C:\Users\user\Desktop\agHzhs8gQd.exe"
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Process created: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe "C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="agHzhs8gQd.exe"
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Process created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe "C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe"
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del "C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Process created: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe "C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\user\Desktop" ORIGINALSETUPEXENAME="agHzhs8gQd.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Process created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe "C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c del "C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: msftedit.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: intl.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: glib-2.0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: gmodule-2.0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: gobject-2.0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: gthread-2.0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: vmtools.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: iconv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: pla.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: tdh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe File written: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\SuiteSetup.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File opened: C:\Windows\SysWOW64\msftedit.dll Jump to behavior
Source: agHzhs8gQd.exe Static file information: File size 11471704 > 1048576
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll Jump to behavior
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: agHzhs8gQd.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: agHzhs8gQd.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: c:\toolchain\src\libiconv-1.9.2\libiconv-1.9.2\windows\vc90\Win32\Release\dll\iconv.pdb source: vmtoolsd.exe, 00000003.00000002.2189840391.000000001010D000.00000002.00000001.01000000.00000010.sdmp, iconv.dll.2.dr
Source: Binary string: useractivitybroker.pdbGCTL source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365976757.00000000003BD000.00000008.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gmodule-2.0.pdbu source: vmtoolsd.exe, 00000003.00000002.2191543903.000000006EAF3000.00000002.00000001.01000000.0000000C.sdmp, gmodule-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gthread-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191426192.000000006E554000.00000002.00000001.01000000.0000000E.sdmp, gthread-2.0.dll.2.dr
Source: Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365880709.00000000003A6000.00000002.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdb source: agHzhs8gQd.exe, _is7F4B.exe.0.dr
Source: Binary string: useractivitybroker.pdb source: netsh.exe, 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3365976757.00000000003BD000.00000008.00000001.01000000.00000000.sdmp, ndctuqmlimdssk.4.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\glib-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191072215.000000006C965000.00000002.00000001.01000000.0000000B.sdmp, glib-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gobject-2.0.pdbe} source: vmtoolsd.exe, 00000003.00000002.2190762975.000000006C878000.00000002.00000001.01000000.0000000D.sdmp, gobject-2.0.dll.2.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb+ source: vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\SetupSuite.pdbK source: agHzhs8gQd.exe, _is7F4B.exe.0.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb source: vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr
Source: Binary string: wntdll.pdbUGP source: vmtoolsd.exe, 00000003.00000002.2189493372.00000000032DE000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390174035.000000000532E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390462106.0000000005770000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367571436.000000000493B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367751694.0000000004C90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\toolchain\src\gettext-0.14.6-2\gettext-0.14.6\gettext-runtime\windows\vc90\Release\bin\intl.pdb source: vmtoolsd.exe, 00000003.00000002.2191305330.000000006DE80000.00000002.00000001.01000000.0000000A.sdmp, intl.dll.2.dr
Source: Binary string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\services\vmtoolsd\vmtoolsd.pdb source: vmtoolsd.exe, 00000003.00000000.2135073330.0000000000AD7000.00000002.00000001.01000000.00000009.sdmp, vmtoolsd.exe, 00000003.00000002.2188801509.0000000000AD7000.00000002.00000001.01000000.00000009.sdmp, vmtoolsd.exe.2.dr
Source: Binary string: wntdll.pdb source: vmtoolsd.exe, 00000003.00000002.2189493372.00000000032DE000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390174035.000000000532E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000002.2390462106.0000000005770000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367571436.000000000493B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3367751694.0000000004C90000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gobject-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2190762975.000000006C878000.00000002.00000001.01000000.0000000D.sdmp, gobject-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gthread-2.0.pdb% source: vmtoolsd.exe, 00000003.00000002.2191426192.000000006E554000.00000002.00000001.01000000.0000000E.sdmp, gthread-2.0.dll.2.dr
Source: Binary string: c:\toolchain\src\glib-2.22.4-3\glib-2.22.4\build\win32\vs8\Release\bin\gmodule-2.0.pdb source: vmtoolsd.exe, 00000003.00000002.2191543903.000000006EAF3000.00000002.00000001.01000000.0000000C.sdmp, gmodule-2.0.dll.2.dr
Source: Binary string: C:\CodeBases\isdev\redist\language independent\i386\Setup_UI.pdb source: Setup_UI.dll.2.dr
Source: agHzhs8gQd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: agHzhs8gQd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: agHzhs8gQd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: agHzhs8gQd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: agHzhs8gQd.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01045F70 LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_01045F70
PE file contains an invalid checksum
Source: ndctuqmlimdssk.4.dr Static PE information: real checksum: 0x0 should be: 0x58b26
Source: intl.dll.2.dr Static PE information: real checksum: 0x181d6 should be: 0x1ee55
PE file contains sections with non-standard names
Source: agHzhs8gQd.exe Static PE information: section name: .orpc
Source: _is7F4B.exe.0.dr Static PE information: section name: .orpc
Source: ndctuqmlimdssk.4.dr Static PE information: section name: mgaw
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_010717F3 push ecx; ret 0_2_01071806
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01071F46 push ecx; ret 0_2_01071F59
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC17F3 push ecx; ret 2_2_00AC1806
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC1F46 push ecx; ret 2_2_00AC1F59
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD6571 push ecx; ret 3_2_00AD6584
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FEC5D push ecx; ret 3_2_6C7FEC70
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\glib-2.0.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\gthread-2.0.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtools.dll Jump to dropped file
Source: C:\Users\user\Desktop\agHzhs8gQd.exe File created: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\gmodule-2.0.dll Jump to dropped file
Source: C:\Windows\SysWOW64\netsh.exe File created: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\iconv.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Setup_UI.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\gobject-2.0.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\intl.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\SysWOW64\netsh.exe File created: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\LicenseAgreement.rtf Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe File created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\LicenseAgreement.rtf Jump to behavior
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Windows\SysWOW64\netsh.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Windows\SysWOW64\netsh.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD5E80 StartServiceCtrlDispatcherW,GetLastError,SetEvent, 3_2_00AD5E80

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Windows\SysWOW64\netsh.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NDCTUQMLIMDSSK
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C803D80 ProcMgr_ListProcesses,GetProcAddress,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryW,GetProcAddress,FreeLibrary, 3_2_6C803D80
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Contain functionality to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: vmtoolsdControlWndClass vmtoolsdControlWndTitle vmtoolsdControlWndClass %S\VMwareToolsQuitEvent_%s %S\VMwareToolsDumpStateEvent_%s 3_2_00AD1880
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd vmtoolsd Runs the VMware Tools daemon. VMware Tools daemon, version vmtoolsd %S\VMwareToolsQuitEvent_%s %S\VMwareToolsDumpStateEvent_%s 3_2_00AD3AC0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: d:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/pluginMgr.c vmtoolsd 3_2_00AD2600
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: d:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/threadPool.c vmtoolsd 3_2_00AD33F0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: vmtoolsd vmtoolsd VMware Tools Service VMTools 3_2_00AD1530
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: @&!*@*@(cmdline.rpcerror)Unable to send command to VMware hypervisor. vmtoolsd 3_2_00AD3910
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: vmware vmware 3_2_6C7BACF0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: VMware software The version of this program is incompatible with your %s.For information on updating your VMware Tools please seehttp://www.vmware.com/info?id=99 3_2_6C805ED0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: VMware User Group VMware User Group 3_2_6C7C3FD0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: __vmware__ W32Util_GetVMwareGroupSid VMware User Group W32Util_GetVMwareGroupSid 3_2_6C7C3870
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: VMTools_ConfigGetString VMTools_ConfigGetString 3_2_6C8014B0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: VMTools_ConfigGetInteger VMTools_ConfigGetInteger 3_2_6C801430
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: apps/vmtoolslib/stub-crypto.c apps/vmtoolslib/stub-crypto.c 3_2_6C7FF2B0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/i18n.c d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/i18n.c d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/i18n.c 3_2_6C7B12A0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: apps/vmtoolslib/stub-crypto.c apps/vmtoolslib/stub-crypto.c apps/vmtoolslib/stub-crypto.c 3_2_6C7FF290
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: VMTools_ConfigGetBoolean VMTools_ConfigGetBoolean VMTools_ConfigGetBoolean 3_2_6C801340
Contains functionality to detect virtual machines (IN, VMware)
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C806BE0 in eax, dx 3_2_6C806BE0
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe API/Special instruction interceptor: Address: 6C635B2D
Source: C:\Windows\SysWOW64\netsh.exe API/Special instruction interceptor: Address: 6C633AF9
Source: C:\Windows\SysWOW64\explorer.exe API/Special instruction interceptor: Address: 102A159
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe File opened / queried: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtools.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe File opened / queried: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe.Local\ Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe File opened / queried: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 180000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 462 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 508 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Window / User API: threadDelayed 6326 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\SysWOW64\netsh.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Setup_UI.dll Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\agHzhs8gQd.exe API coverage: 7.8 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\explorer.exe TID: 2644 Thread sleep count: 462 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2644 Thread sleep time: -13860000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1372 Thread sleep count: 508 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1372 Thread sleep time: -91440000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2644 Thread sleep count: 6326 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2644 Thread sleep time: -189780000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107F504 FindFirstFileExW, 0_2_0107F504
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FDFE90 FindFirstFileW,__CxxThrowException@8,FindClose, 0_2_00FDFE90
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AB71CB __EH_prolog3_GS,GetModuleHandleW,GetModuleHandleW,GetProcAddress,FindFirstFileW,GetModuleHandleW,GetProcAddress, 2_2_00AB71CB
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00ACF504 FindFirstFileExW, 2_2_00ACF504
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A2FE90 FindFirstFileW,__CxxThrowException@8,FindClose, 2_2_00A2FE90
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C4E50 strchr,Log,Unicode_GetAllocBytes,UtilSafeMalloc0,wcscspn,wcschr,wcschr,wcschr,wcschr,UtilSafeRealloc0,memcpy,towupper,wcscspn,UtilSafeRealloc0,memcpy,FindFirstFileW,FindClose,wcsspn,UtilSafeRealloc0,memcpy,Unicode_AllocWithLength,free,free,free,free, 3_2_6C7C4E50
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7BBEC0 Unicode_GetAllocBytes,free,FindFirstFileW,GetLastError,free,Err_Errno2String,Log,Err_Errno2String,Log, 3_2_6C7BBEC0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C4FB8 wcscspn,UtilSafeRealloc0,memcpy,FindFirstFileW,FindClose,wcsspn,UtilSafeRealloc0,memcpy,Unicode_AllocWithLength,free,free,free,free, 3_2_6C7C4FB8
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7BABE0 Str_Asprintf,Warning,Win32U_FindFirstFileW,free,Str_Asprintf,free,FindNextFileW,Warning,FindClose, 3_2_6C7BABE0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7C21C0 Win32U_FindFirstFileW,Unicode_GetAllocBytes,FindFirstFileW,free, 3_2_6C7C21C0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7F3600 WiperPartition_Open,Panic,Win32U_GetLogicalDriveStrings,GetLastError,Log,free,free,free, 3_2_6C7F3600
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0106A285 GetModuleHandleW,GetProcAddress,GetSystemInfo,GetNativeSystemInfo, 0_2_0106A285
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread delayed: delay time: 30000 Jump to behavior
Source: vmtoolsd.exe.2.dr Binary or memory string: Command line parsing failedRuns the VMware Tools daemon.%s %sversion@&!*@*@(cmdline.version)Prints the daemon version and exits.log@&!*@*@(cmdline.log)Ignored, kept for backwards compatibility.debug@&!*@*@(cmdline.debug)Runs in debug mode, using the given plugin.config@&!*@*@(cmdline.config)Uses the config file at the given path.@&!*@*@(cmdline.displayname.argument)namedisplayname@&!*@*@(cmdline.displayname)Service display name (only used with -i).uninstall@&!*@*@(cmdline.uninstall)Uninstalls the service from the Service Control Manager.@&!*@*@(cmdline.install.args)argsinstall@&!*@*@(cmdline.install)Installs the service with the Service Control Manager.@&!*@*@(cmdline.kill)Stops a running instance of a tools service.killdump-state@&!*@*@(cmdline.state)Dumps the internal state of a running service instance to the logs.@&!*@*@(cmdline.rpc.command)commandcmd@&!*@*@(cmdline.rpc)Sends an RPC command to the host and exits.plugin-path@&!*@*@(cmdline.pluginpath)Path to the plugin directory.@&!*@*@(cmdline.path)pathcommon-path@&!*@*@(cmdline.commonpath)Path to the common plugin directory.@&!*@*@(cmdline.name.argument)svcnamename@&!*@*@(cmdline.name)Name of the service being started.D
Source: vmtools.dll.2.dr Binary or memory string: CompanyNameVMware, Inc.b
Source: intl.dll.2.dr Binary or memory string: http://www.vmware.com/0
Source: vmtoolsd.exe Binary or memory string: @&!*@*@(msg.panic.requestSupport.vmSupport.tools.win32) To collect data to submit to VMware technical support, run "vm-support.vbs" in the VMware Tools installation directory.
Source: vmtoolsd.exe.2.dr Binary or memory string: file %s: line %d: assertion `%s' failedd:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/pluginMgr.cprov->regType != existing->prov->regTypeCannot find provider for app type %d, plugin %s may not work.
Source: vmtoolsd.exe Binary or memory string: %S\VMwareToolsQuitEvent_%s
Source: vmtools.dll.2.dr Binary or memory string: VMware software%s: backdoor not detected.
Source: vmtools.dll.2.dr Binary or memory string: VMTools_SetGuestSDKMode
Source: vmtoolsd.exe.2.dr Binary or memory string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\services\vmtoolsd\vmtoolsd.pdb
Source: vmtoolsd.exe Binary or memory string: apps/vmtoolslib/stub-crypto.c
Source: vmtools.dll.2.dr Binary or memory string: VMTools_WriteConfig
Source: netsh.exe, 00000004.00000002.2389435788.0000000002BF0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: _is7F4B.exe, 00000002.00000003.2192629335.00000000013D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtoolsd.exell
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ConfigGetBoolean%s: Returning default value for '[%s] %s'=%d.
Source: _is7F4B.exe, 00000002.00000002.2193825321.000000000147E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmtoolsd.exevmtoolsd.exeDm
Source: vmtoolsd.exe Binary or memory string: The version of this program is incompatible with your %s.For information on updating your VMware Tools please seehttp://www.vmware.com/info?id=99
Source: vmtoolsd.exe Binary or memory string: The version of this program is incompatible with your %s. For information on updating your VMware Tools please see http://www.vmware.com/info?id=99
Source: spoolsv.lnk.4.dr Binary or memory string: :.\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe
Source: vmtoolsd.exe.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/pluginMgr.c
Source: vmtools.dll.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/i18n.c
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exel.ngg
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ConfigGetBoolean
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: P[SETUPSUPPORTDIR]Coba\vmtoolsd.exep\{559FA71-57BD-4A52-8476-E475BE1A4E2E}\etu.xml=Yeslder.pgng&
Source: _is7F4B.exe, 00000002.00000002.2193504233.00000000013E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtools.dll\c
Source: _is7F4B.exe, 00000002.00000002.2193357085.00000000013B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtools.dll1
Source: vmtoolsd.exe, 00000003.00000002.2189069192.0000000001598000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 6-E475BE1A4E2E}\Coba\vmtools.dll.2.Configee
Source: explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: noreply@vmware.com0
Source: vmtools.dll.2.dr Binary or memory string: vmware
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_NewHandleSource
Source: vmtools.dll.2.dr Binary or memory string: me de fichiers inconnu. Contactez VMware
Source: vmtoolsd.exe Binary or memory string: @&!*@*@(msg.panic.requestSupport.vmSupport.tools.win32)To collect data to submit to VMware technical support, run "vm-support.vbs" in the VMware Tools installation directory.
Source: vmtools.dll.2.dr Binary or memory string: MXUser_ReleaseRWLockd:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/vmtoolsConfig.cUnable to close "%s": %s
Source: vmtoolsd.exe Binary or memory string: vmtoolsdControlWndTitle
Source: vmtoolsd.exe.2.dr Binary or memory string: vmtools
Source: vmtools.dll.2.dr Binary or memory string: Lecteur de disques virtuels)Type de lecteur inconnu. Contactez VMwarePA
Source: vmtools.dll.2.dr Binary or memory string: VMware software
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_LoadConfig
Source: vmtools.dll.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/i18n.cApplication did not set up a default text domain.NOT_IMPLEMENTED %s:%d
Source: _is7F4B.exe, 00000002.00000003.2192629335.00000000013D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtoolsd.exe
Source: spoolsv.lnk.4.dr Binary or memory string: vmtoolsd.exe
Source: vmtools.dll.2.dr Binary or memory string: no timeunknowndebuginfomessagewarningcriticalerror<null>Invalid path for domain '%s'.%s%sTemp%s%s-%s.logvmware%windir%loggingMissing path for domain '%s'.%s.maxOldLogFiles%s.maxLogSize%s.dataInvalid handler for domain '%s': %sVMware ToolssyslogoutputdebugstringvmxFailed to create a logger for handler: '%s'stdfile+fileUnknown log level (%s): %s
Source: _is7F4B.exe.0.dr Binary or memory string: Coba\vmtoolsd.exe}
Source: _is7F4B.exe, 00000002.00000002.2193825321.000000000147E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: file:///C:/Users/user/AppData/Local/Temp/%7B55B9FA71-57BD-4A52-8476-E475BE1A4E2E%7D/Coba/vmtoolsd.exeUp
Source: vmtoolsd.exe, 00000003.00000002.2189007331.0000000001460000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\Desktop\C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe"C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe" C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exeWinsta0\Default
Source: vmtools.dll.2.dr Binary or memory string: W32Util_RobustGetLongPathVMwareGetModuleHandleExWUnrecoverable memory allocation failure at %s:%u
Source: vmtools.dll.2.dr Binary or memory string: <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="VMware.VMware.vmtools" type="win32"></assemblyIdentity><description>"VMware Tools Runtime Library"</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo></assembly>PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Coba\vmtoolsd.exe
Source: vmtoolsd.exe Binary or memory string: VMware Tools Service
Source: vmtoolsd.exe.2.dr Binary or memory string: %S\VMwareToolsDumpStateEvent_%sNamed event for 'QuitEvent' already exists. Exiting.
Source: vmtools.dll.2.dr Binary or memory string: To collect data to submit to VMware technical support, run "vm-support.vbs" in the VMware Tools installation directory.
Source: vmtools.dll.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/vmtoolsConfig.c
Source: vmtools.dll.2.dr Binary or memory string: VMware Tools
Source: vmtools.dll.2.dr Binary or memory string: Software\VMware, Inc.\VMware Tools
Source: vmtoolsd.exe Binary or memory string: __vmware__
Source: _is7F4B.exe, 00000002.00000003.2192629335.00000000013D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtools.dllr
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_BindTextDomain
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_ConfigLogging
Source: vmtools.dll.2.dr Binary or memory string: | VMwarePA
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ChangeLogFilePath
Source: vmtools.dll.2.dr Binary or memory string: VMTools_WrapArray
Source: vmtools.dll.2.dr Binary or memory string: ble5Sistema de archivos desconocido. Contactar con VMware
Source: _is7F4B.exe, 00000002.00000002.2193825321.000000000147E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sers\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe
Source: vmtools.dll.2.dr Binary or memory string: rimovibile1File system sconosciuto. Contatta supporto VMware
Source: vmtoolsd.exe.2.dr Binary or memory string: vmtoolsd
Source: _is7F4B.exe.0.dr Binary or memory string: Coba\vmtools.dll}
Source: _is7F4B.exe, 00000002.00000002.2193357085.00000000013B8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtools.dll
Source: vmtools.dll.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/vmtoolsLog.c
Source: vmtools.dll.2.dr Binary or memory string: RamDisk-Laufwerk3Unbekannter Laufwerktyp. Wenden Sie sich an VMware.
Source: vmtools.dll.2.dr Binary or memory string: Unidad de disco RAM5Tipo de controlador desconocido. Contactar con VMware2GetDiskFreeSpaceEx() f
Source: _is7F4B.exe, 00000002.00000002.2193504233.00000000013E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Coba\vmtools.dll
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: /C:/Users/user/AppData/Local/Temp/%7B55B9FA71-57BD-4A52-8476-E475BE1A4E2E%7D/Coba/vmtoolsd.exe
Source: vmtools.dll.2.dr Binary or memory string: VMware
Source: vmtools.dll.2.dr Binary or memory string: file %s: line %d: assertion `%s' failedd:/build/ob/bora-4448491/bora-vmsoft/apps/vmtoolslib/vmtoolsLog.cdefaultDomain != NULLCore dump flags set to %ucoreDumpFlagsenableCoreDumpLog caching is disabled.Log caching is enabled with maxCacheEntries=%d.Invalid value for maxCacheEntries key: Error %d.maxCacheEntrieslog.levelDropped %u log messages from cache.Flushed %u log messages from cache after resuming log IO.Recursive panic, giving up.
Source: vmtools.dll.2.dr Binary or memory string: InstallPathVMware ToolsAppDataPathd:/build/ob/bora-4448491/bora/lib/user/win32util.cvolatileUUIDHost-%2x%2x-%2x%2x%2x%2x%2x%2x%lx-%hx-%hx%02x %02x %02x %02x %02x %02x %02x %02x-%02x %02x %02x %02x %02x %02x %02x %02xMachineGuidSOFTWARE\Microsoft\Cryptography%s: Random_Crypto failure!
Source: _is7F4B.exe, 00000002.00000003.2192510706.00000000013FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: P[SETUPSUPPORTDIR]Coba\vmtoolsd.exe\l
Source: vmtools.dll.2.dr Binary or memory string: FileDescriptionVMware Tools Runtime Library8
Source: vmtools.dll.2.dr Binary or memory string: VMTools_BindTextDomain[%8s] [%s] %s
Source: vmtoolsd.exe.2.dr Binary or memory string: VMware Tools daemon, version%s: %s
Source: vmtools.dll.2.dr Binary or memory string: InternalNamevmtoolsj#
Source: explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1!0
Source: vmtools.dll.2.dr Binary or memory string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb+
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmtoolsd.exeJ
Source: vmtools.dll.2.dr Binary or memory string: W32Util_GetVMwareGroupSid
Source: vmtools.dll.2.dr Binary or memory string: apps/vmtoolslib/stub-crypto.cd:/build/ob/bora-4448491/bora/lib/misc/vthreadBase.cVThreadBase reinitialization, old: %d %s, new: %d %s.
Source: vmtoolsd.exe.2.dr Binary or memory string: services/vmtoolsd/svcSignals-gm.c
Source: explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware, Inc.1
Source: intl.dll.2.dr Binary or memory string: VMware, Inc.0
Source: vmtools.dll.2.dr Binary or memory string: . VMware
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ConfigGetString
Source: _is7F4B.exe, 00000002.00000003.2192629335.00000000013D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtools.dll{
Source: vmtools.dll.2.dr Binary or memory string: W32Util_GetVMwareGroupSid__vmware__%s: Failed directory attributes check, "%s"
Source: vmtoolsd.exe, 00000003.00000002.2190468444.000000006C811000.00000002.00000001.01000000.0000000F.sdmp, vmtools.dll.2.dr Binary or memory string: HGFSDrive %s, Unable to get volume information: %u
Source: _is7F4B.exe, 00000002.00000002.2193504233.00000000013E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 0Coba\vmtoolsd.exe\AppDta\
Source: intl.dll.2.dr Binary or memory string: VMware, Inc.1>0<
Source: vmtoolsd.exe.2.dr Binary or memory string: vmtools.dll
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_AttachConsole+
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_SuspendLogIO
Source: setup.xml.2.dr Binary or memory string: <CallExe Id="NewAction" DefaultCode="Abort" WaitForExit="Yes" File="[SETUPSUPPORTDIR]Coba\vmtoolsd.exe" AbortCOde="0" Window="Hide"/>
Source: vmtools.dll.2.dr Binary or memory string: GetSystemFirmwareTableKernel32.dll%s\%sSOFTWARE\%sVMware, Inc.UUIDCreateRandomUnstylizedDrive %s, Type is %08X
Source: vmtoolsd.exe Binary or memory string: \\.\VMCI
Source: vmtools.dll.2.dr Binary or memory string: VMware User Group%s: LookupAccountNameW: %d
Source: vmtoolsd.exe.2.dr Binary or memory string: ProductNameVMware ToolsP
Source: vmtools.dll.2.dr Binary or memory string: 0VMware k0J0OUD0
Source: vmtools.dll.2.dr Binary or memory string: 10.0.12d:/build/ob/bora-4448491/bora/lib/productState/productState.cproductStateLockSOFTWARE\VMware, Inc.\%sReleaseSRWLockExclusiveAcquireSRWLockExclusiveReleaseSRWLockSharedAcquireSRWLockSharedInitializeSRWLockholderCount %d
Source: vmtools.dll.2.dr Binary or memory string: SimpleSock: Couldn't get VMCI socket family info.
Source: vmtools.dll.2.dr Binary or memory string: d:\build\ob\bora-4448491\bora-vmsoft\build\release\tools-for-windows\Win32\apps\vmtoolslib\vmtools.pdb
Source: vmtoolsd.exe Binary or memory string: %S\VMwareToolsDumpStateEvent_%s
Source: vmtoolsd.exe.2.dr Binary or memory string: services/vmtoolsd/svcSignals-gm.creturn_value != NULLn_param_values == 3n_param_values == 4n_param_values == 6Service UninstallCould not remove %S. Error %d
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_BindTextDomain0
Source: spoolsv.lnk.4.dr Binary or memory string: f2vmtoolsd.exeJ
Source: netsh.exe, 00000004.00000002.2390018001.0000000004C70000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe
Source: vmtools.dll.2.dr Binary or memory string: SOFTWARE\VMware, Inc.\%s
Source: vmtoolsd.exe.2.dr Binary or memory string: %S\VMwareToolsQuitEvent_%sFailed to create control window: %uvmtoolsdControlWndTitlevmtoolsdControlWndClassLocalGlobalWaitForSingleObject failed: %u.
Source: vmtools.dll.2.dr Binary or memory string: VMTools_GetUtf16String
Source: vmtools.dll.2.dr Binary or memory string: \\.\VMCISimpleSock: Unsupported Winsock version %d.%d
Source: vmtools.dll.2.dr Binary or memory string: http://www.vmware.com/info?id=99
Source: _is7F4B.exe, 00000002.00000003.2191653254.000000000145E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware.VMware.vmtoolsd^
Source: _is7F4B.exe, 00000002.00000002.2193251902.0000000000FF0000.00000004.00000020.00040000.00000000.sdmp Binary or memory string: 4E2E}\Coba\vmtoolsd.exeen-GBenen-USVMware.VMware.vmtoolsd^
Source: vmtools.dll.2.dr Binary or memory string: VMware, Inc.
Source: vmtoolsd.exe.2.dr Binary or memory string: Runs the VMware Tools daemon.
Source: vmtoolsd.exe.2.dr Binary or memory string: FileDescriptionVMware Tools Core Service8
Source: vmtoolsd.exe, 00000003.00000002.2189069192.0000000001598000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exepu
Source: vmtoolsd.exe.2.dr Binary or memory string: tools.set.version %utools.set.versiontype %u %uvmtoolsdisable-tools-versionUnable to register guest conf directory capability.
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: p\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe
Source: vmtools.dll.2.dr Binary or memory string: GuestApp_GetInstallPathSoftware\VMware, Inc.\VMware ToolsInstallPath%s: Error: Add system Ace to Acl failed %u
Source: vmtools.dll.2.dr Binary or memory string: apps/vmtoolslib/stub-crypto.c
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ConfigGetInteger
Source: explorer.exe, 00000009.00000002.3366626141.0000000000B9B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: http://www.vmware.com/0/
Source: _is7F4B.exe, 00000002.00000003.2192419126.000000000142D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe.rfng
Source: vmtoolsd.exe.2.dr Binary or memory string: InternalNamevmtoolsdj#
Source: vmtools.dll.2.dr Binary or memory string: SSLCheckLockingCallbacksslConnectionLockSoftware\VMware, Inc.\VMware Toolspoweron-vm-default.batpoweron-scriptpoweroff-vm-default.batpoweroff-scriptresume-vm-default.batresume-scriptsuspend-vm-default.batsuspend-script%s: Couldn't get data for value "%S".
Source: vmtools.dll.2.dr Binary or memory string: | VMware
Source: setup.xml.2.dr Binary or memory string: <Resource Stream="Coba\vmtools.dll"/>
Source: vmtools.dll.2.dr Binary or memory string: Ramdisk drive"Unknown drive type. Contact VMware
Source: vmtoolsd.exe.2.dr Binary or memory string: d:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/threadPool.c
Source: vmtools.dll.2.dr Binary or memory string: VMTools_CreateTimer
Source: netsh.exe, 00000004.00000002.2389435788.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.3366133731.0000000000858000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: setup.xml.2.dr Binary or memory string: <Resource Stream="Coba\vmtoolsd.exe"/>
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_LoadConfigB
Source: vmtoolsd.exe Binary or memory string: vmtoolsdControlWndClass
Source: vmtools.dll.2.dr Binary or memory string: For information on updating your VMware Tools please see
Source: vmtoolsd.exe Binary or memory string: VMware User Group
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_NewHandleSource4
Source: vmtools.dll.2.dr Binary or memory string: Wechsellaufwerk3Unbekanntes Dateisystem. Wenden Sie sich an VMware.
Source: _is7F4B.exe, 00000002.00000002.2193825321.000000000147E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: vmtoolsd.exevmtoolsd.exe
Source: vmtoolsd.exe.2.dr Binary or memory string: VMware Tools daemon, version
Source: spoolsv.lnk.4.dr Binary or memory string: .vmtoolsd.exe
Source: _is7F4B.exe, 00000002.00000002.2193825321.000000000147E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe" :.
Source: vmtoolsd.exe.2.dr Binary or memory string: VMToolsVMware Tools ServiceCannot convert to UTF16: %s
Source: vmtoolsd.exe.2.dr Binary or memory string: Str_Vasprintfvmtools.dllRCloseHandleY
Source: netsh.exe, 00000004.00000002.2390063848.0000000004CE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: a\vmtoolsd.exe
Source: vmtoolsd.exe.2.dr Binary or memory string: @&!*@*@(cmdline.rpcerror)Unable to send command to VMware hypervisor.
Source: vmtoolsd.exe Binary or memory string: VMTools
Source: vmtoolsd.exe.2.dr Binary or memory string: tcs_shutdowntcs_capabilitieserror sending work request, executing in service thread: %sd:/build/ob/bora-4448491/bora-vmsoft/services/vmtoolsd/threadPool.cid != 0failed to start thread: %s.error initializing thread pool, running single threaded: %spool.maxUnusedThreadspool.maxIdleTimetcs_prop_thread_poolpool.maxThreads@&!*@*@(cmdline.rpcerror)Unable to send command to VMware hypervisor.%s
Source: vmtoolsd.exe.2.dr Binary or memory string: <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="VMware.VMware.vmtoolsd" type="win32"></assemblyIdentity><description>"VMware Tools Core Service"</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings xmlns:settings="http://schemas.microsoft.com/SMI/2005/WindowsSettings"><settings:dpiAware>True/PM</settings:dpiAware></windowsSettings></application><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"></supportedOS><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"></supportedOS><supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"></supportedOS></application></compatibility></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
Source: vmtoolsd.exe, 00000003.00000002.2189069192.0000000001598000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtools.dll9\M
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_AttachConsole
Source: vmtoolsd.exe, 00000003.00000002.2189069192.0000000001590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: C:\Users\user\Desktop\C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe"C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe" C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: vmtools.dll.2.dr Binary or memory string: W32Util_GetVmwareCommonAppDataFilePath
Source: explorer.exe, 00000009.00000002.3366626141.0000000000B53000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %APPDATA%\Microsoft\Windows\Start Menu\Programs\StartupCoInitializeExCoCreateInstance%WINDIR%\Microsoft.NET\Frameworkv2.0.50727v3.5v4.0.30319MSBuild.exe%windir%\SysWOW64%windir%\System32%windir%\SysWOW64\explorer.exespoolsvHttpMake%windir%\SysWOW64\explorer.exemshtml.dllC:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe2
Source: vmtoolsd.exe, 00000003.00000002.2189069192.0000000001590000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: "C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe"
Source: vmtools.dll.2.dr Binary or memory string: VMTools_ConfigGetIntegerVMTools_ConfigGetStringconfig != NULLBackup config exists, skipping backup.
Source: vmtoolsd.exe.2.dr Binary or memory string: OriginalFilenamevmtoolsd.exe:
Source: vmtools.dll.2.dr Binary or memory string: Removable drive"Unknown filesystem. Contact VMware
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_GetString
Source: vmtools.dll.2.dr Binary or memory string: sconosciuto. Contatta supporto VMware
Source: vmtoolsd.exe.2.dr Binary or memory string: CompanyNameVMware, Inc.\
Source: vmtoolsd.exe.2.dr Binary or memory string: 1998-2016 VMware, Inc.B
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_ResumeLogIO8
Source: vmtools.dll.2.dr Binary or memory string: OriginalFilenamevmtools.dll:
Source: vmtoolsd.exe.2.dr Binary or memory string: VMTools_ResumeLogIO
Source: vmtools.dll.2.dr Binary or memory string: 1998-2016 VMware, Inc.@
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01064743 IsDebuggerPresent,OutputDebugStringW, 0_2_01064743
Contains functionality to create guard pages, often used to hinder reverse usering and debugging
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107A488 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C 0_2_0107A488
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01045F70 LoadLibraryW,GetProcAddress,FreeLibrary, 0_2_01045F70
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107AC25 mov eax, dword ptr fs:[00000030h] 0_2_0107AC25
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00ACAC25 mov eax, dword ptr fs:[00000030h] 2_2_00ACAC25
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0107FC41 GetProcessHeap, 0_2_0107FC41
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01071B12 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_01071B12
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01071D11 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_01071D11
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01071EA3 SetUnhandledExceptionFilter, 0_2_01071EA3
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01076E3D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_01076E3D
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC1B12 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 2_2_00AC1B12
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC1D11 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00AC1D11
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC1EA3 SetUnhandledExceptionFilter, 2_2_00AC1EA3
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00AC6E3D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00AC6E3D
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD62A6 SetUnhandledExceptionFilter, 3_2_00AD62A6
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD61F0 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess, 3_2_00AD61F0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7FE3F2 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess, 3_2_6C7FE3F2
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7B83A0 TlsAlloc,Panic,SetUnhandledExceptionFilter, 3_2_6C7B83A0

HIPS / PFW / Operating System Protection Evasion
barindex
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\SysWOW64\netsh.exe Memory written: PID: 4412 base: 10279C0 value: 55 Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Memory written: PID: 4412 base: 535008 value: 00 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Section loaded: NULL target: C:\Windows\SysWOW64\netsh.exe protection: read write Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\netsh.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 10279C0 Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 535008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Process created: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe "C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01067EF7 __EH_prolog3_GS,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,AllocateAndInitializeSid,SetEntriesInAclW,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetTempPathW, 0_2_01067EF7
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_0106E985 GetCurrentThread,OpenThreadToken,GetLastError,GetLastError,GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,new,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid, 0_2_0106E985
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01071FC8 cpuid 0_2_01071FC8
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,g_strdup_printf,GetLastError,g_strdup, 3_2_6C7B1190
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Queries volume information: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\ISLogoSmall.png VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Queries volume information: C:\Windows\SysWOW64\explorer.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FF4A80 CreateNamedPipeW,CloseHandle,GetLastError,CreateEventW,WaitForSingleObject,new,CloseHandle,CloseHandle,CloseHandle, 0_2_00FF4A80
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_01072172 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_01072172
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7BADF0 File_GetSafeTmpDir,MXUser_CreateSingletonExclLock,Panic,MXUser_AcquireExclLock,UtilSafeStrdup0,Warning,Win32U_GetUserName,Warning,Str_Asprintf,Warning,free,free,UtilSafeStrdup0,MXUser_ReleaseExclLock,free, 3_2_6C7BADF0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FF4F10 GetVersionExW,SetLastError, 0_2_00FF4F10

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys stealer DLL
Source: Yara match File source: 9.2.explorer.exe.370000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.netsh.exe.5c700c8.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.netsh.exe.5c700c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.3365824204.0000000000371000.00000020.00000001.01000000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.2390701649.0000000005C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\ndctuqmlimdssk, type: DROPPED
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FD10E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 0_2_00FD10E0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FD1040 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 0_2_00FD1040
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FD11F0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 0_2_00FD11F0
Source: C:\Users\user\Desktop\agHzhs8gQd.exe Code function: 0_2_00FD1180 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 0_2_00FD1180
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A210E0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 2_2_00A210E0
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A21040 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 2_2_00A21040
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A21180 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 2_2_00A21180
Source: C:\Users\user\AppData\Local\Temp\{8FE30872-7B9B-4574-8A17-C33E6CAA59E3}\_is7F4B.exe Code function: 2_2_00A211F0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ, 2_2_00A211F0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD2AE0 GuestApp_GetInstallPath,g_strdup_printf,vm_free,g_ptr_array_new,g_strdup_printf,g_file_test_utf8,g_strdup_printf,g_file_test_utf8,g_file_test_utf8,g_ptr_array_new,g_log,g_module_close,g_module_error,g_free,g_free,g_module_make_resident,g_ptr_array_add,VMTools_BindTextDomain,g_module_close,g_module_error,g_free,g_free,g_malloc,VMTools_BindTextDomain,g_ptr_array_add,g_ptr_array_free,g_free, 3_2_00AD2AE0
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_00AD1530 __ehhandler$?_Init@?$numpunct@_W@std@@IAEXABV_Locinfo@2@_N@Z,memset,SetErrorMode,Unicode_InitW,setlocale,VMTools_ConfigLogging,VMTools_BindTextDomain,g_str_has_prefix,VMTools_AttachConsole,CodeSet_Utf8ToUtf16le,CodeSet_Utf8ToUtf16le,vm_free,??2@YAPAXI@Z,vm_free,vm_free,??2@YAPAXI@Z, 3_2_00AD1530
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7B1900 VMTools_BindTextDomain,g_once_impl,g_strdup_printf,File_IsFile, 3_2_6C7B1900
Source: C:\Users\user\AppData\Local\Temp\{55B9FA71-57BD-4A52-8476-E475BE1A4E2E}\Coba\vmtoolsd.exe Code function: 3_2_6C7B5150 Warning,Debug,socket,WSAGetLastError,Err_Errno2String,Warning,bind,WSAGetLastError,Debug,Debug,Err_Errno2String,Warning,Debug,connect,WSAGetLastError,Err_Errno2String,Debug,Debug, 3_2_6C7B5150
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1614214 Sample: agHzhs8gQd.exe Startdate: 13/02/2025 Architecture: WINDOWS Score: 100 47 kataraus.info 2->47 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 Antivirus detection for dropped file 2->61 63 8 other signatures 2->63 10 agHzhs8gQd.exe 11 2->10         started        signatures3 process4 file5 35 C:\Users\user\AppData\Local\...\_is7F4B.exe, PE32 10->35 dropped 37 C:\Users\user\...\_is7F4B.exe:Zone.Identifier, ASCII 10->37 dropped 13 _is7F4B.exe 1 138 10->13         started        process6 file7 39 C:\Users\user\AppData\Local\...\Setup_UI.dll, PE32 13->39 dropped 41 C:\Users\user\AppData\Local\...\vmtoolsd.exe, PE32 13->41 dropped 43 C:\Users\user\AppData\Local\...\vmtools.dll, PE32 13->43 dropped 45 6 other malicious files 13->45 dropped 75 Antivirus detection for dropped file 13->75 77 Multi AV Scanner detection for dropped file 13->77 17 vmtoolsd.exe 1 13->17         started        20 cmd.exe 1 13->20         started        signatures8 process9 signatures10 49 Contains functionality to detect virtual machines (IN, VMware) 17->49 51 Contain functionality to detect virtual machines 17->51 53 Uses netsh to modify the Windows network and firewall settings 17->53 55 2 other signatures 17->55 22 netsh.exe 6 17->22         started        26 conhost.exe 20->26         started        process11 file12 33 C:\Users\user\AppData\...\ndctuqmlimdssk, PE32 22->33 dropped 65 Injects code into the Windows Explorer (explorer.exe) 22->65 67 Writes to foreign memory regions 22->67 69 Found hidden mapped module (file has been removed from disk) 22->69 71 Switches to a custom stack to bypass stack traces 22->71 28 explorer.exe 12 22->28         started        31 conhost.exe 22->31         started        signatures13 process14 signatures15 73 Switches to a custom stack to bypass stack traces 28->73
⊘No contacted IP infos

Contacted Domains

Name IP Active
kataraus.info unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
kataraus.info/mbSDvj3/index.php true
  • Avira URL Cloud: safe
 unknown