Windows Analysis Report
zNWl7z1FbW.exe

Overview

General Information

Sample name:	zNWl7z1FbW.exe renamed because original name is a hash value
Original sample name:	58dae216d7e872a5ac859cb6990165c8a1b6c10b7d39498b3b38327bf8500ae5.exe
Analysis ID:	1515134
MD5:	42a97cec33e8c8e987d5739fbd3c9f00
SHA1:	1704e208451006c59a246e65fce67860f9c76c2f
SHA256:	58dae216d7e872a5ac859cb6990165c8a1b6c10b7d39498b3b38327bf8500ae5
Tags:	exeuser-Chainskilabs
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Creates autostart registry keys with suspicious names

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Sigma detected: New RUN Key Pointing to Suspicious Folder

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: zNWl7z1FbW.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Avira: detection malicious, Label: HEUR/AGEN.1324459
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe	Avira: detection malicious, Label: HEUR/AGEN.1324459

Found malware configuration

Source: 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Njrat {"Host": "seznam.hopto.org", "Port": "1177", "Version": "0.7d", "Campaign ID": "KARLA 1998", "Install Name": "facebok.exe", "Install Dir": "TEMP", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for domain / URL

Source: seznam.hopto.org

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe	Virustotal: Detection: 72%	Perma Link

Multi AV Scanner detection for submitted file

Source: zNWl7z1FbW.exe	Virustotal: Detection: 72%			Perma Link
Source: zNWl7z1FbW.exe	ReversingLabs: Detection: 63%

Yara detected Njrat

Source: Yara match	File source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zNWl7z1FbW.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: facebok.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: facebok.exe PID: 6680, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: zNWl7z1FbW.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: zNWl7z1FbW.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49708 -> 34.145.18.233:1177
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49708 -> 34.145.18.233:1177
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.7:49708 -> 34.145.18.233:1177
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.7:49708 -> 34.145.18.233:1177
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49708 -> 34.145.18.233:1177
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.7:49708 -> 34.145.18.233:1177

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.7:49708 -> 34.145.18.233:1177

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ATGS-MMD-ASUS ATGS-MMD-ASUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: seznam.hopto.org

Source: zNWl7z1FbW.exe, 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 0000000E.00000002.1702252307.0000000002782000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 0000000F.00000002.1784462438.0000000002C92000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, kl.cs	.Net Code: VKCodeToUnicode
Source: 13.2.facebok.exe.282535c.0.raw.unpack, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zNWl7z1FbW.exe PID: 7620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: facebok.exe PID: 7916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: facebok.exe PID: 6680, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\facebok.exe

Process information set: 01 00 00 00

Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects njRAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects njRAT Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08973EA8 NtSetInformationProcess,		9_2_08973EA8
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08973EA0 NtSetInformationProcess,		9_2_08973EA0

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0170ECD0	5_2_0170ECD0
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0170D534	5_2_0170D534
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_05711B60	5_2_05711B60
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_05711B50	5_2_05711B50
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0774DB58	5_2_0774DB58
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0774325B	5_2_0774325B
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07742D28	5_2_07742D28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_00FFEF28	9_2_00FFEF28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_00FFD534	9_2_00FFD534
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_0766E170	9_2_0766E170
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_0766DB48	9_2_0766DB48
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_07663250	9_2_07663250
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_07662D28	9_2_07662D28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08975A08	9_2_08975A08
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_0897DE68	9_2_0897DE68
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08971F34	9_2_08971F34
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_0897E738	9_2_0897E738
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_0897DB20	9_2_0897DB20
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08974680	9_2_08974680
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08973704	9_2_08973704
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 9_2_08A307B8	9_2_08A307B8
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_024FEF28	13_2_024FEF28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_024FD534	13_2_024FD534
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_072DE170	13_2_072DE170
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_072DDB48	13_2_072DDB48
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_072D3250	13_2_072D3250
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_072D2D28	13_2_072D2D28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_00C3EF28	14_2_00C3EF28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_00C3D534	14_2_00C3D534
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_0737E170	14_2_0737E170
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_0737DB48	14_2_0737DB48
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_07373250	14_2_07373250
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_07372D28	14_2_07372D28
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_086811C0	14_2_086811C0
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 15_2_0121ECD0	15_2_0121ECD0
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 15_2_0121D534	15_2_0121D534
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 15_2_0786DB58	15_2_0786DB58
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 15_2_07863250	15_2_07863250
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 15_2_07862D28	15_2_07862D28

Source: zNWl7z1FbW.exe, 00000005.00000002.1372487210.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs zNWl7z1FbW.exe
Source: zNWl7z1FbW.exe, 00000005.00000000.1278036138.0000000000D3E000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameROTANA PC.exe4 vs zNWl7z1FbW.exe
Source: zNWl7z1FbW.exe	Binary or memory string: OriginalFilenameROTANA PC.exe4 vs zNWl7z1FbW.exe

Source: zNWl7z1FbW.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: facebok.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 36db42ed563b740681ec3918ded7c343.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8024:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Mutant created: \Sessions\1\BaseNamedObjects\36db42ed563b740681ec3918ded7c343

Source: unknown	Process created: C:\Users\user\Desktop\zNWl7z1FbW.exe "C:\Users\user\Desktop\zNWl7z1FbW.exe"
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Process created: C:\Users\user\AppData\Local\Temp\facebok.exe "C:\Users\user\AppData\Local\Temp\facebok.exe"
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\facebok.exe" "facebok.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\facebok.exe "C:\Users\user\AppData\Local\Temp\facebok.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\facebok.exe "C:\Users\user\AppData\Local\Temp\facebok.exe" ..
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\facebok.exe "C:\Users\user\AppData\Local\Temp\facebok.exe" ..
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Process created: C:\Users\user\AppData\Local\Temp\facebok.exe "C:\Users\user\AppData\Local\Temp\facebok.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Local\Temp\facebok.exe" "facebok.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Section loaded: textshaping.dll	Jump to behavior

Source: zNWl7z1FbW.exe, .cs	.Net Code: System.AppDomain.Load(byte[])
Source: facebok.exe.5.dr, .cs	.Net Code: System.AppDomain.Load(byte[])
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 5.2.zNWl7z1FbW.exe.41f1ad0.1.raw.unpack, .cs	.Net Code: System.AppDomain.Load(byte[])
Source: 36db42ed563b740681ec3918ded7c343.exe.9.dr, .cs	.Net Code: System.AppDomain.Load(byte[])
Source: 13.2.facebok.exe.282535c.0.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571D41E push ds; retn 0007h	5_2_0571D42A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571C0B9 push ss; retn 0007h	5_2_0571C0BA
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571D0A0 push ds; retn 0007h	5_2_0571D42A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_05715220 pushad ; retf	5_2_05715221
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_05715222 push esp; retf	5_2_05715229
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571FF00 pushfd ; retn 0007h	5_2_0571FF01
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571B831 push cs; retn 0007h	5_2_0571B832
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_0571B810 push cs; retn 0007h	5_2_0571B812
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077446B0 push edx; retn 0007h	5_2_077446B2
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077442E0 push ecx; retn 0007h	5_2_077442E2
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077451EF push edi; retn 0007h	5_2_077451F2
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07746069 pushad ; retn 0007h	5_2_0774606A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077460C8 pushad ; retn 0007h	5_2_077460CA
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07746098 pushad ; retn 0007h	5_2_0774609A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744F99 push esi; retn 0007h	5_2_07744F9A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744EA1 push ebp; retn 0007h	5_2_07744EA2
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07746EA8 push eax; retn 0007h	5_2_07746EA9
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744D77 push ebx; retn 0007h	5_2_07744D7A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744D47 push ebx; retn 0007h	5_2_07744D4A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744D17 push ebx; retn 0007h	5_2_07744D1A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744DB1 push esp; retn 0007h	5_2_07744DB2
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077449C8 push ebx; retn 0007h	5_2_077449CA
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_07744998 push ebx; retn 0007h	5_2_0774499A
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Code function: 5_2_077F5D0D push FFFFFF8Bh; iretd	5_2_077F5D0F
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_024F84BC push esp; retn 0004h	13_2_024FD9D2
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_024F8D89 push ss; retn 0004h	13_2_024F8D8A
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_085E4E0A push dword ptr [ebx+ebp-75h]; iretd	13_2_085E4E15
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 13_2_085E4F05 push FFFFFF8Bh; iretd	13_2_085E4F07
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_00C384BC push esp; retf	14_2_00C3D9D2
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_00C38D89 push ss; retf	14_2_00C38D8A
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Code function: 14_2_00C350FA push ebx; ret	14_2_00C350FB

Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 13.2.facebok.exe.282535c.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 13.2.facebok.exe.282535c.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_njRat date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects njRAT, reference = http://malwareconfig.com/stats/njRat
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000005.00000002.1373284779.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: RAT_njRat date = 01.04.2014, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, description = Detects njRAT, reference = http://malwareconfig.com/stats/njRat
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0000000D.00000002.1618109637.0000000002711000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: zNWl7z1FbW.exe	Static PE information: section name: .text entropy: 7.889995559025786
Source: facebok.exe.5.dr	Static PE information: section name: .text entropy: 7.889995559025786
Source: 36db42ed563b740681ec3918ded7c343.exe.9.dr	Static PE information: section name: .text entropy: 7.889995559025786

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	File created: C:\Users\user\AppData\Local\Temp\facebok.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36db42ed563b740681ec3918ded7c343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 36db42ed563b740681ec3918ded7c343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 36db42ed563b740681ec3918ded7c343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 36db42ed563b740681ec3918ded7c343	Jump to behavior

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Memory allocated: 1700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Memory allocated: 1780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 28F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 24F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 2710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Window / User API: threadDelayed 946	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Window / User API: threadDelayed 3607	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Window / User API: threadDelayed 4808	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Window / User API: foregroundWindowGot 1763	Jump to behavior

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe TID: 7668	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe TID: 7920	Thread sleep time: -946000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe TID: 7920	Thread sleep time: -4808000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe TID: 3868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe TID: 6684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe TID: 6700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: netsh.exe, 0000000A.00000003.1447573999.0000000000B91000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000A.00000002.1447923851.0000000000B94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllx
Source: zNWl7z1FbW.exe, 00000005.00000002.1372566077.0000000001502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: zNWl7z1FbW.exe, 00000005.00000002.1372566077.0000000001502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: facebok.exe, 00000009.00000002.3746125879.0000000005EF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: 5.2.zNWl7z1FbW.exe.32052d4.0.raw.unpack, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: facebok.exe, 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 00000009.00000002.3736355510.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, facebok.exe, 00000009.00000002.3738942313.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: facebok.exe, 00000009.00000002.3736355510.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerA#
Source: facebok.exe, 00000009.00000002.3736355510.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager3
Source: facebok.exe, 00000009.00000002.3736355510.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managert
Source: facebok.exe, 00000009.00000002.3736355510.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerpm
Source: facebok.exe, 00000009.00000002.3738942313.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, facebok.exe, 00000009.00000002.3738942313.0000000002C47000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\

Windows Analysis Report zNWl7z1FbW.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
zNWl7z1FbW.exe

Malware Threat Intel
Provided by

Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Users\user\Desktop\zNWl7z1FbW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\zNWl7z1FbW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\facebok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\facebok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\facebok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\facebok.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\facebok.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior

ID:	1515134
Product:	CloudBasic
Start time:	19:46:07
Start date:	21.09.2024
Sample:	zNWl7z1FbW.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	42a97cec33e8c8e987d5739fbd3c9f00
SHA1:	1704e208451006c59a246e65fce67860f9c76c2f
SHA256:	58dae216d7e872a5ac859cb6990165c8a1b6c10b7d39498b3b38327bf8500ae5
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\facebok.exe.log	ASCII text, with CRLF line terminators	877F8337F3495A9C54E7164C3021623D	EB0083C30BCE5CD9627CBD52480B6704FD184A6E	AAE808611887E0D4B6B6D6BAA0664B9CC7E5BBF621A8B5A8C7C711D2608C6300
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zNWl7z1FbW.exe.log	ASCII text, with CRLF line terminators	877F8337F3495A9C54E7164C3021623D	EB0083C30BCE5CD9627CBD52480B6704FD184A6E	AAE808611887E0D4B6B6D6BAA0664B9CC7E5BBF621A8B5A8C7C711D2608C6300
C:\Users\user\AppData\Local\Temp\facebok.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	42A97CEC33E8C8E987D5739FBD3C9F00	1704E208451006C59A246E65FCE67860F9C76C2F	58DAE216D7E872A5AC859CB6990165C8A1B6C10B7D39498B3B38327BF8500AE5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\36db42ed563b740681ec3918ded7c343.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	42A97CEC33E8C8E987D5739FBD3C9F00	1704E208451006C59A246E65FCE67860F9C76C2F	58DAE216D7E872A5AC859CB6990165C8A1B6C10B7D39498B3B38327BF8500AE5
\Device\ConDrv	ASCII text, with CRLF line terminators	689E2126A85BF55121488295EE068FA1	09BAAA253A49D80C18326DFBCA106551EBF22DD6	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25