Windows Analysis Report
PPz346dmz6.exe

Overview

General Information

Sample name:	PPz346dmz6.exe renamed because original name is a hash value
Original sample name:	1d556a333267e4161f3d613ba5304de0.exe
Analysis ID:	1507723
MD5:	1d556a333267e4161f3d613ba5304de0
SHA1:	bdb291aeeb0a30ae38285e3387f93c04405882ae
SHA256:	053bb9bc1549cd2dc4e84b8d53735171ed1e62810cedb71c48210fe1487b8fb5
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Creates an autostart registry key pointing to binary in C:\Windows

Disables zone checking for all users

Drops PE files to the startup folder

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Dllhost Internet Connection

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PPz346dmz6.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Dllhost.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Avira: detection malicious, Label: TR/Dropper.Gen7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack

Malware Configuration Extractor: Njrat {"Install Dir": "WinDir", "Install Name": "Dllhost.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "???", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Server.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Virustotal: Detection: 73%	Perma Link
Source: C:\Windows\Dllhost.exe	ReversingLabs: Detection: 86%
Source: C:\Windows\Dllhost.exe	Virustotal: Detection: 73%	Perma Link

Multi AV Scanner detection for submitted file

Source: PPz346dmz6.exe	ReversingLabs: Detection: 86%
Source: PPz346dmz6.exe	Virustotal: Detection: 73%			Perma Link

Yara detected Njrat

Source: Yara match	File source: PPz346dmz6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2020483262.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2086340320.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PPz346dmz6.exe PID: 3524, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Dllhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\Dllhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: PPz346dmz6.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: PPz346dmz6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PPz346dmz6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49712 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49712 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49712 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49712 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49712 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49715 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49715 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49715 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49715 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49704 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49714 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49717 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49717 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49717 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49717 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49718 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49718 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49718 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49718 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49719 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49719 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49719 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49719 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49720 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49720 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49720 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49720 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49721 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49721 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49721 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49721 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49716 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49716 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.5:49716 -> 147.185.221.22:32480
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49716 -> 147.185.221.22:32480

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Dllhost.exe

Network Connect: 147.185.221.22 32480

Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.2020483262.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.2020483262.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.2086340320.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.2086340320.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E2B38 NtSetInformationProcess,		2_2_026E2B38
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E2B30 NtSetInformationProcess,		2_2_026E2B30

Source: C:\Windows\Dllhost.exe	Code function: 2_2_00AB5B30	2_2_00AB5B30
Source: C:\Windows\Dllhost.exe	Code function: 2_2_00ABAB14	2_2_00ABAB14
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E0040	2_2_026E0040
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E91A8	2_2_026E91A8
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026EAD5C	2_2_026EAD5C
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026EBE68	2_2_026EBE68
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026EDC50	2_2_026EDC50
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026EAD59	2_2_026EAD59
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E8DCC	2_2_026E8DCC
Source: C:\Windows\Dllhost.exe	Code function: 2_2_026E0D80	2_2_026E0D80

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Mutant created: NULL
Source: C:\Windows\Dllhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Update

Source: unknown	Process created: C:\Users\user\Desktop\PPz346dmz6.exe "C:\Users\user\Desktop\PPz346dmz6.exe"
Source: unknown	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Process created: C:\Windows\Dllhost.exe "C:\Windows\Dllhost.exe"
Source: C:\Windows\Dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Windows\Dllhost.exe "C:\Windows\Dllhost.exe" ..
Source: unknown	Process created: C:\Windows\Dllhost.exe "C:\Windows\Dllhost.exe" ..
Source: unknown	Process created: C:\Windows\Dllhost.exe "C:\Windows\Dllhost.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Server.exe C:\Users\user\AppData\Local\Temp/Server.exe
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Process created: C:\Windows\Dllhost.exe "C:\Windows\Dllhost.exe"	Jump to behavior
Source: C:\Windows\Dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\user\AppData\Local\Temp/Server.exe	Jump to behavior

Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Section loaded: uxtheme.dll

Source: PPz346dmz6.exe, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Dllhost.exe.0.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Java update.exe.2.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Server.exe.2.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\PPz346dmz6.exe	File created: C:\Windows\Dllhost.exe	Jump to dropped file
Source: C:\Windows\Dllhost.exe	File created: C:\Users\user\AppData\Local\Temp\Server.exe	Jump to dropped file
Source: C:\Windows\Dllhost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Jump to dropped file

Source: C:\Windows\Dllhost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Windows\Dllhost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Windows\Dllhost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior
Source: C:\Windows\Dllhost.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Update	Jump to behavior

Source: C:\Users\user\Desktop\PPz346dmz6.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Memory allocated: 4F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 4FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 4C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Dllhost.exe	Memory allocated: 2840000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 24E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Memory allocated: 44E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 1540000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 52A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 4AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 25E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 4640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 14E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2F00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Memory allocated: 2D00000 memory reserve \| memory write watch

Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: PPz346dmz6.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.PPz346dmz6.exe.bf0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.PPz346dmz6.exe.2f75ffc.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.2020483262.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.2020483262.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.2086340320.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.2086340320.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\Server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Windows\Dllhost.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: C:\Users\user\Desktop\PPz346dmz6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Dllhost.exe	Window / User API: threadDelayed 1013	Jump to behavior
Source: C:\Windows\Dllhost.exe	Window / User API: threadDelayed 4137	Jump to behavior
Source: C:\Windows\Dllhost.exe	Window / User API: threadDelayed 3943	Jump to behavior
Source: C:\Windows\Dllhost.exe	Window / User API: foregroundWindowGot 615	Jump to behavior
Source: C:\Windows\Dllhost.exe	Window / User API: foregroundWindowGot 621	Jump to behavior

Source: C:\Users\user\Desktop\PPz346dmz6.exe TID: 1476	Thread sleep count: 52 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe TID: 1436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 6612	Thread sleep time: -101300s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 5004	Thread sleep time: -4137000s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 5004	Thread sleep time: -3943000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 6196	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 6620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 2520	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 2520	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 6468	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 2968	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 6360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 3496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 4084	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 6224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Dllhost.exe TID: 4084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 5228	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe TID: 5508	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 576	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 5160	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 1960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 3596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 2640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 3848	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe TID: 7040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PPz346dmz6.exe	Queries volume information: C:\Users\user\Desktop\PPz346dmz6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PPz346dmz6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Dllhost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Dllhost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Server.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: Dllhost.exe, 00000002.00000002.4488441991.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s%\Windows Defender\MsMpeng.exe
Source: Dllhost.exe, 00000002.00000002.4501988465.00000000060F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: indows Defender\MsMpeng.exe
Source: Dllhost.exe, 00000002.00000002.4488441991.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000002.00000002.4501888273.00000000060D6000.00000004.00000020.00020000.00000000.sdmp, Dllhost.exe, 00000002.00000002.4488441991.0000000000A6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Dllhost.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

ID:	1507723
Product:	CloudBasic
Start time:	06:56:05
Start date:	09.09.2024
Sample:	PPz346dmz6.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	1d556a333267e4161f3d613ba5304de0
SHA1:	bdb291aeeb0a30ae38285e3387f93c04405882ae
SHA256:	053bb9bc1549cd2dc4e84b8d53735171ed1e62810cedb71c48210fe1487b8fb5
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dllhost.exe.log	ASCII text, with CRLF line terminators	285ADD706E818D58486213C030BD9ED5	3593842190DB067FC23F4E3E7A8FC69263800A47	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Java update.exe.log	ASCII text, with CRLF line terminators	285ADD706E818D58486213C030BD9ED5	3593842190DB067FC23F4E3E7A8FC69263800A47	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PPz346dmz6.exe.log	ASCII text, with CRLF line terminators	285ADD706E818D58486213C030BD9ED5	3593842190DB067FC23F4E3E7A8FC69263800A47	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.log	ASCII text, with CRLF line terminators	285ADD706E818D58486213C030BD9ED5	3593842190DB067FC23F4E3E7A8FC69263800A47	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
C:\Users\user\AppData\Local\Temp\Server.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	1D556A333267E4161F3D613BA5304DE0	BDB291AEEB0A30AE38285E3387F93C04405882AE	053BB9BC1549CD2DC4E84B8D53735171ED1E62810CEDB71C48210FE1487B8FB5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	1D556A333267E4161F3D613BA5304DE0	BDB291AEEB0A30AE38285E3387F93C04405882AE	053BB9BC1549CD2DC4E84B8D53735171ED1E62810CEDB71C48210FE1487B8FB5
C:\Windows\Dllhost.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	1D556A333267E4161F3D613BA5304DE0	BDB291AEEB0A30AE38285E3387F93C04405882AE	053BB9BC1549CD2DC4E84B8D53735171ED1E62810CEDB71C48210FE1487B8FB5

Windows Analysis Report PPz346dmz6.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
PPz346dmz6.exe

Malware Threat Intel
Provided by