Edit tour

Windows Analysis Report
DSR0987678900000.exe

Overview

General Information

Sample name:	DSR0987678900000.exe
Analysis ID:	1519446
MD5:	780e6f2c7b7d9742a94b9e2da18b58fd
SHA1:	275324c7b0b61ddc600df5c690ea35f780114ed8
SHA256:	8a5e154d88d238dc9a6970558ffd02bbd00dd786a0e7d51c3cea80badeb78e7e
Tags:	exeuser-TeamDreier
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Disables UAC (registry)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DSR0987678900000.exe (PID: 2756 cmdline: "C:\Users\user\Desktop\DSR0987678900000.exe" MD5: 780E6F2C7B7D9742A94B9E2DA18B58FD)

powershell.exe (PID: 5824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7652 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

AddInProcess32.exe (PID: 6048 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

WerFault.exe (PID: 7204 cmdline: C:\Windows\system32\WerFault.exe -u -p 2756 -s 1224 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.antoniomayol.com:21", "Username": "johnson@antoniomayol.com", "Password": "cMhKDQUk1{;%"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DSR0987678900000.exe PID: 2756	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DSR0987678900000.exe PID: 2756	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DSR0987678900000.exe PID: 2756	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: DSR0987678900000.exe PID: 2756	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: AddInProcess32.exe PID: 6048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 6048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DSR0987678900000.exe.1eb90889740.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DSR0987678900000.exe.1eb90889740.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DSR0987678900000.exe.1eb90889740.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32935:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x329a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32a31:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ac3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32b2d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b9f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32cc5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DSR0987678900000.exe.1eb90889740.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2fb6b:$s2: GetPrivateProfileString 0x2f218:$s3: get_OSFullName 0x30906:$s5: remove_Key 0x30ab3:$s5: remove_Key 0x31995:$s6: FtpWebRequest 0x32917:$s7: logins 0x32e89:$s7: logins 0x35b8e:$s7: logins 0x35c4c:$s7: logins 0x375a1:$s7: logins 0x367e6:$s9: 1.85 (Hash, version 2, native byte-order)
3.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
3.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x385e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32935:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x329a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32a31:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32ac3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32b2d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b9f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32cc5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2fb6b:$s2: GetPrivateProfileString 0x2f218:$s3: get_OSFullName 0x30906:$s5: remove_Key 0x30ab3:$s5: remove_Key 0x31995:$s6: FtpWebRequest 0x32917:$s7: logins 0x32e89:$s7: logins 0x35b8e:$s7: logins 0x35c4c:$s7: logins 0x375a1:$s7: logins 0x367e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x385e6:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34735:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x7057d:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x347a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x705ef:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34831:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x70679:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x348c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7070b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3492d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x70775:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3499f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x707e7:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a35:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x7087d:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34ac5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7090d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x3196b:$s2: GetPrivateProfileString 0x6d7b3:$s2: GetPrivateProfileString 0x31018:$s3: get_OSFullName 0x6ce60:$s3: get_OSFullName 0x32706:$s5: remove_Key 0x328b3:$s5: remove_Key 0x6e54e:$s5: remove_Key 0x6e6fb:$s5: remove_Key 0x33795:$s6: FtpWebRequest 0x6f5dd:$s6: FtpWebRequest 0x34717:$s7: logins 0x34c89:$s7: logins 0x3798e:$s7: logins 0x37a4c:$s7: logins 0x393a1:$s7: logins 0x7055f:$s7: logins 0x70ad1:$s7: logins 0x737d6:$s7: logins 0x73894:$s7: logins 0x751e9:$s7: logins 0x385e6:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 18 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DSR0987678900000.exe", ParentImage: C:\Users\user\Desktop\DSR0987678900000.exe, ParentProcessId: 2756, ParentProcessName: DSR0987678900000.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, ProcessId: 5824, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\DSR0987678900000.exe", ParentImage: C:\Users\user\Desktop\DSR0987678900000.exe, ParentProcessId: 2756, ParentProcessName: DSR0987678900000.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force, ProcessId: 5824, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ftp.antoniomayol.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 3.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.antoniomayol.com:21", "Username": "johnson@antoniomayol.com", "Password": "cMhKDQUk1{;%"}

Multi AV Scanner detection for submitted file

Source: DSR0987678900000.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DSR0987678900000.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DSR0987678900000.exe PID: 2756, type: MEMORYSTR

Source: DSR0987678900000.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: pC:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32{"0 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbNM-R source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb$ source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb9 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: .pdbHJ source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DSR0987678900000.PDB_s source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb6 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF053E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32objr\x86\Microsoft.VisualBasic.pdbx source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbces source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb5619 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbL source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF055B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbO source: DSR0987678900000.exe, 00000000.00000002.1999258647.000001EBEDFD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdbh source: WERA6F.tmp.dmp.6.dr

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 15.197.240.20 15.197.240.20

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: TANDEMUS TANDEMUS

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.antoniomayol.com
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: AddInProcess32.exe, 00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.antoniomayol.com
Source: AddInProcess32.exe, 00000003.00000002.4220462335.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4220462335.0000000003131000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: AddInProcess32.exe, 00000003.00000002.4220462335.0000000003131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, R1W.cs	.Net Code: HAg81
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, R1W.cs	.Net Code: HAg81

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B9033D0	0_2_00007FFD9B9033D0
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B908E60	0_2_00007FFD9B908E60
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B90BAA0	0_2_00007FFD9B90BAA0
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B9045F0	0_2_00007FFD9B9045F0
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B90EA09	0_2_00007FFD9B90EA09
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B914A2B	0_2_00007FFD9B914A2B
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B9044A0	0_2_00007FFD9B9044A0
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B9D026B	0_2_00007FFD9B9D026B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_01714A88	3_2_01714A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0171AD88	3_2_0171AD88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_01713E70	3_2_01713E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_017141B8	3_2_017141B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0692C600	3_2_0692C600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_0692AD78	3_2_0692AD78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A66C0	3_2_069A66C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A5270	3_2_069A5270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069AC270	3_2_069AC270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069AB309	3_2_069AB309
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A3138	3_2_069A3138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A7E50	3_2_069A7E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A7770	3_2_069A7770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A2430	3_2_069A2430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069AE478	3_2_069AE478
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A0040	3_2_069A0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A59AB	3_2_069A59AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A0006	3_2_069A0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 3_2_069A0038	3_2_069A0038

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2756 -s 1224

Source: DSR0987678900000.exe

Static PE information: No import functions for PE file found

Source: DSR0987678900000.exe, 00000000.00000000.1753112308.000001EBEDE12000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameTransponer.exe6 vs DSR0987678900000.exe
Source: DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamee6c7e90e-20ff-4cd0-a277-0023958459c3.exe4 vs DSR0987678900000.exe
Source: DSR0987678900000.exe	Binary or memory string: OriginalFilenameTransponer.exe6 vs DSR0987678900000.exe

Source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: DSR0987678900000.exe, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, KLhJmaON.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 7hO8luD.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, 9HIFdl.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: DSR0987678900000.exe, 00000000.00000002.1999258647.000001EBEDFD6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbO

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@8/10@5/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2756

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljiicu1b.ymn.ps1

Jump to behavior

Source: DSR0987678900000.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: DSR0987678900000.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\DSR0987678900000.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DSR0987678900000.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\DSR0987678900000.exe

File read: C:\Users\user\Desktop\DSR0987678900000.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DSR0987678900000.exe "C:\Users\user\Desktop\DSR0987678900000.exe"
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2756 -s 1224
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\DSR0987678900000.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DSR0987678900000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: DSR0987678900000.exe

Static file information: File size 3794463 > 1048576

Source: DSR0987678900000.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: pC:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32{"0 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdbNM-R source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb$ source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb9 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: .pdbHJ source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DSR0987678900000.PDB_s source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb6 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF053E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \Registry\Machine\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32objr\x86\Microsoft.VisualBasic.pdbx source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbces source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb5619 source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF05C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbL source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF0571000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: C:\Users\user\Desktop\DSR0987678900000.PDB source: DSR0987678900000.exe, 00000000.00000002.1994769675.00000015735F3000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: DSR0987678900000.exe, 00000000.00000002.2002043543.000001EBF055B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbO source: DSR0987678900000.exe, 00000000.00000002.1999258647.000001EBEDFD6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA6F.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdbh source: WERA6F.tmp.dmp.6.dr

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B907C2E pushad ; retf	0_2_00007FFD9B907C5D
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B907C5E push eax; retf	0_2_00007FFD9B907C6D
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Code function: 0_2_00007FFD9B9D026B push esp; retf 4810h	0_2_00007FFD9B9D0312

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (31).png

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DSR0987678900000.exe PID: 2756, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\DSR0987678900000.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp, DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLP
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAMEP

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory allocated: 1EBEE180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory allocated: 1EBEFAF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 1710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 3130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2F60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmmouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	File opened / queried: C:\WINDOWS\system32\drivers\vmhgfs.sys	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	File opened / queried: C:\WINDOWS\system32\drivers\VBoxMouse.sys	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597945	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595470	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594926	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594012	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593797	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5640	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 5470	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 4364	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7272	Thread sleep count: 5470 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7272	Thread sleep count: 4364 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599561s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598319s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -598102s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597945s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597835s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596824s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596608s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -596030s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595470s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595311s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -595045s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594926s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -594012s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -593906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7268	Thread sleep time: -593797s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598319	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597945	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597835	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596824	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595470	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594926	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594012	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593797	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMUP
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware ToolsP
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: vmware
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: hgfsZrw6
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: &C:\WINDOWS\system32\drivers\vmhgfs.sysP
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREP
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareP
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: AddInProcess32.exe, 00000003.00000002.4223608817.000000000644D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllHA_
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: )C:\WINDOWS\system32\drivers\VBoxMouse.sysP
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\P
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIP
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'C:\WINDOWS\system32\drivers\vmmouse.sysP
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: DSR0987678900000.exe, 00000000.00000002.1994968952.000001EB80041000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: "SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 3_2_01717070 CheckRemoteDebuggerPresent,

3_2_01717070

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: DSR0987678900000.exe, --.cs	Reference to suspicious API methods: LoadLibrary(_FD45_FDD5(_FBB5_FDE4_FDCA_FDD7._061D))
Source: DSR0987678900000.exe, --.cs	Reference to suspicious API methods: GetProcAddress(intPtr, _FD45_FDD5(_FBB5_FDE4_FDCA_FDD7._FDD7_0609_FDEA_FDEB))
Source: DSR0987678900000.exe, --.cs	Reference to suspicious API methods: VirtualProtect(procAddress, (uint)array.ToArray().Length, 64u, out var _FBB6)
Source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, moEk.cs	Reference to suspicious API methods: EYAPsVT.OpenProcess(CgGfQLvbm.DuplicateHandle, bInheritHandle: true, (uint)_2y5.ProcessID)

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: F1E008	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force			Jump to behavior
Source: C:\Users\user\Desktop\DSR0987678900000.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"			Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe	Queries volume information: C:\Users\user\Desktop\DSR0987678900000.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\DSR0987678900000.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DSR0987678900000.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 6048, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DSR0987678900000.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 6048, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb90889740.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DSR0987678900000.exe.1eb9084d8f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DSR0987678900000.exe PID: 2756, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 6048, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	211 Process Injection	1 Masquerading	2 OS Credential Dumping	551 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	271 Virtualization/Sandbox Evasion	1 Credentials in Registry	271 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	211 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DSR0987678900000.exe	26%	ReversingLabs
DSR0987678900000.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	Avira URL Cloud	safe
http://ftp.antoniomayol.com	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ip-api.com	208.95.112.1	true	true	unknown
ftp.antoniomayol.com	15.197.240.20	true	true	unknown
241.42.69.40.in-addr.arpa	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
http://ftp.antoniomayol.com	AddInProcess32.exe, 00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.dyn.com/	DSR0987678900000.exe, 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AddInProcess32.exe, 00000003.00000002.4220462335.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AddInProcess32.exe, 00000003.00000002.4220462335.0000000003131000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
15.197.240.20	ftp.antoniomayol.com	United States		7430	TANDEMUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519446
Start date and time:	2024-09-26 15:08:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DSR0987678900000.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@8/10@5/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 72 Number of non-executed functions: 6
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: DSR0987678900000.exe

Simulations

Behavior and APIs

Time	Type	Description
09:09:15	API Interceptor	10410389x Sleep call for process: AddInProcess32.exe modified
09:09:21	API Interceptor	44x Sleep call for process: powershell.exe modified
09:09:33	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	450230549.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	ip-api.com/json/
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO Invoice XJ210821Q.PDF.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO Invoice XJ210821Q.PDF.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
15.197.240.20	OjKmJJm2YT.exe	Get hash	malicious	Simda Stealer	Browse	qexyhuv.com/login.php
	5AFlyarMds.exe	Get hash	malicious	Simda Stealer	Browse	qexyhuv.com/login.php
	uB31aJH4M0.exe	Get hash	malicious	Simda Stealer	Browse	qexyhuv.com/login.php
	0XLuA614VK.exe	Get hash	malicious	FormBook	Browse	www.marinamaquiagens.online/n4sv/
	8htbxM8GPX.exe	Get hash	malicious	FormBook	Browse	www.donnavariedades.com/fo8o/
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	qexyhuv.com/login.php
	roundwood.exe	Get hash	malicious	Simda Stealer	Browse	qexyhuv.com/login.php
	rPHOTO09AUG2024.exe	Get hash	malicious	FormBook	Browse	www.donnavariedades.com/fo8o/
	QLLafoDdqv.exe	Get hash	malicious	FormBook	Browse	www.donnavariedades.com/fo8o/
	LF2024022.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.johnasian.com/jn17/?AjFxkn=AUopA6EtHNKAXsGcnergFbbGiEMiDoIvdiVznSugjPZqqO5N3A9xjJjKmrW26oeiLAOH&Yxl0T=CPqtRfop

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	450230549.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	http://getcloudapp.com	Get hash	malicious	Unknown	Browse	208.95.112.2
	PO Invoice XJ210821Q.PDF.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TANDEMUS	https://telstra-104088.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://telstra-100710.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://sky-108991.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	https://telstra-100834.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://att-108495.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
	https://netzero-webmail-106441.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://shaw-101354.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://connect-trezarhelp.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://consolbisezsproslogin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	15.197.193.217
	https://att-mail-109008.weeblysite.com/	Get hash	malicious	Unknown	Browse	15.197.193.217
TUT-ASUS	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	450230549.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE_467654.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DSR0987678900000_7e74b1b87155529a3ff0bd98fc2c8d3a6c378e49_a7480bc7_055a7e94-47cf-4121-8aa6-26f4dc22353a\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2382927939992026
Encrypted:	false
SSDEEP:	192:UWpBN0bU3Ii0+F/8yaWBUUzeZY/zuiFaZ24lO8i:JFiU3++F/8yamUNCzuiFaY4lO8i
MD5:	87B704044FDCCA5E8D47F708999AFF03
SHA1:	1DF71B9F137F34FBA67F16660D98E15A6DD614EE
SHA-256:	EF8425CEB9F20D9ADB958CFFB8D01FAB5C25FB41FD2F96CEE8CE00DEFE42257A
SHA-512:	B4D7E0F5D1F40B8F29623A353215A9A0327DBC065F831D78DED052F67A5296DA63F1B4B0C8A6716F00A4EA762DAFF9C5899EBDF957D3CD294EC5579D0E3B47F1
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.8.2.9.7.5.4.9.5.4.2.8.4.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.8.2.9.7.5.8.4.8.5.5.3.6.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.5.a.7.e.9.4.-.4.7.c.f.-.4.1.2.1.-.8.a.a.6.-.2.6.f.4.d.c.2.2.3.5.3.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.d.a.5.a.4.3.-.a.2.0.5.-.4.5.e.0.-.b.1.2.a.-.f.5.4.8.9.f.f.f.3.6.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.D.S.R.0.9.8.7.6.7.8.9.0.0.0.0.0...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.T.r.a.n.s.p.o.n.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.c.4.-.0.0.0.1.-.0.0.1.4.-.b.6.4.b.-.2.3.4.6.1.5.1.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.8.7.8.5.3.e.9.0.f.6.0.5.6.a.0.6.1.c.8.9.8.f.b.9.d.3.d.a.1.c.a.0.0.0.0.0.0.0.0.!.0.0.0.0.2.7.5.3.2.4.c.7.b.0.b.6.1.d.d.c.6.0.0.d.f.5.c.6.9.0.e.a.3.5.f.7.8.0.1.1.4.e.d.8.!.D.S.R.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1637.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8646
Entropy (8bit):	3.703133109551088
Encrypted:	false
SSDEEP:	192:R6l7wVeJUIhb6Y9F2WVVgmfZFWMpr989bJQzf8jm:R6lXJDhb6Yf2WVVgmfbWTJkfF
MD5:	0EB5537BCE44B680BA349A07B06B601E
SHA1:	72D258EE20024D74E96B4EC5D6E4FFBC951D7EBD
SHA-256:	2949A64C88BB47793DADCF304D1685840822FD7E4343301F102BD8C6D537FA0D
SHA-512:	B9344E5C58EFA8A5CF881A256FACBD20CF2CA3E5CDB514FDA2FA4980AD82727DCA646C564787BE2317ABB8D000B4398C289532D657C9DE97092C2B07270A0B2D
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A6.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4848
Entropy (8bit):	4.511934896955113
Encrypted:	false
SSDEEP:	48:cvIwWl8zszJg771I9k3WpW8VYj2cYm8M4JgmHE6FQFpyq8vSHE5zj1Bt9th/d:uIjfNI73G7VN5JuFFpWd5FPTh/d
MD5:	F45044ABF668C333E533DA210F90C4A0
SHA1:	00FEF6EED5BBE77377EB703B9EADA928D27CD668
SHA-256:	13B659D677B612B57EA3FD97AC9F92716DBFCE5C594A8E648B864097995858E4
SHA-512:	821A6077313BC1C4FA2BF9EF79D9E2BBE3DEBA392ADA698580536C3295773D8DB4E2FAEE4FBFC5CE6B89FF0445D983BF11286012E062728B504CEF5E728C01F2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="517211" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Thu Sep 26 13:09:17 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	465732
Entropy (8bit):	3.3356898858627932
Encrypted:	false
SSDEEP:	3072:VwUVSY1CCqjzB3+vBl0FeXrCVOj1nwWGROK4pcS7:V/FqjzB3QrfxnwSKS
MD5:	2CCA5AEA3F5527A26368C89BEE6F2EDE
SHA1:	07BF45FA8CA89213F840E8F72889C1D291A6DBEB
SHA-256:	18BE235D5FD6B9EA032788741FF4920CA0E5978AB052EACD2003651E3C66BE59
SHA-512:	9EC9657F943B63167A6EA36BCD374F3D20605EEBD9CB1278ED5FE3E39A40E8B59ED54C96174B7BA9DFD3AB78E086A8069835D123A64D4B72486D27402EAB546F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........\.f............D...........<...d.......$....(....... ...(......DT..$...........l.......8...........T...........(=..............`I..........LK..............................................................................eJ.......K......Lw......................T............\.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul9oj/tz:NllUKj/
MD5:	1558AA0899C27353A68431EE052EC3C4
SHA1:	A2601A25140A3703C8553959F4BD0926B31AAFB5
SHA-256:	3F7936DF95335336DFC5C6BAF55C2628A5AFF0116500ADEE9D40B7DB3941AC88
SHA-512:	CD213BEB302E73101224C3D40E5593661817AB724AD9A6C5DA0B3E748AD85384676573DBC36AE84FD103958CF55BEB712D7BAA8338F071BC3B5C7A9D5ED08E8C
Malicious:	false
Reputation:	low
Preview:	@...e...................................F............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4ti4kez.vbv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka5pv3g1.2pp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljiicu1b.ymn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdt4hkkt.11g.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465715154207638
Encrypted:	false
SSDEEP:	6144:1IXfpi67eLPU9skLmb0b4kWSPKaJG8nAgejZMMhA2gX4WABl0uNCdwBCswSbg:2XD94kWlLZMM6YFHs+g
MD5:	7A97E93C05655782DA0A9E2B88E2C3B7
SHA1:	86ABCA105CB454A6D84DFC9FBCD5228DF49EBA6A
SHA-256:	C90D483577FE508E632EF7E3A9677243F777C3B5221DBEDAE93B65F94AAD301F
SHA-512:	BB7689561C58DB3CDB062F311372A3E1EEA6E6A2FCFE46B0A42AF183CEB73DA60FF323944337C66A5A87DED0B5A9646544BFD5525329A145C9F737E4354BD832
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...H...................................................................................................................................................................................................................................................................................................................................................\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.483236337720919
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	DSR0987678900000.exe
File size:	3'794'463 bytes
MD5:	780e6f2c7b7d9742a94b9e2da18b58fd
SHA1:	275324c7b0b61ddc600df5c690ea35f780114ed8
SHA256:	8a5e154d88d238dc9a6970558ffd02bbd00dd786a0e7d51c3cea80badeb78e7e
SHA512:	496f488ec5f619991b4ec8fd5bdde987315f1c2d18e5158e44d336569ab5c46cdf1d055d5e17c86afea669e1b6480b4bd73af5f5c403af67e415acecee7e8290
SSDEEP:	24576:b1qb6oWgPEfagb8P1Wil/q4GEsYR+xtr8:Ib6/gP/1GEsnr8
TLSH:	FA06D080B5475D93FC095630D9E2B8F051FE6DAB78F4542FDF893D262ABA2BE1021076
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...h..f.........."...0..8...Q........... ....@...... ................................:...`................................

File Icon


Icon Hash:	c5a684988c94a0c5

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F2A468 [Tue Sep 24 11:37:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x3502a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3890	0x3a00	b6d914b74f8a1164814f138ce4ef0226	False	0.6373248922413793	data	6.205273953636364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x3502a	0x35200	e92dcaf8b12995bcaeb2cd2be6ffa02f	False	0.20978860294117646	data	4.435807245040489	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6474	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.3225609756097561
RT_ICON	0x6adc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.43951612903225806
RT_ICON	0x6dc4	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.4016393442622951
RT_ICON	0x6fac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.4831081081081081
RT_ICON	0x70d4	0x35e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9907192575406032
RT_ICON	0xa6b4	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4584221748400853
RT_ICON	0xb55c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.47382671480144406
RT_ICON	0xbe04	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.45564516129032256
RT_ICON	0xc4cc	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3504335260115607
RT_ICON	0xca34	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.07868508221933042
RT_ICON	0x1d25c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.15114568005045195
RT_ICON	0x26704	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.1543233082706767
RT_ICON	0x2ceec	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.175184842883549
RT_ICON	0x32374	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15948275862068967
RT_ICON	0x3659c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.24107883817427386
RT_ICON	0x38b44	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2678236397748593
RT_ICON	0x39bec	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.37459016393442623
RT_ICON	0x3a574	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.42819148936170215
RT_GROUP_ICON	0x3a9dc	0x102	data	0.6046511627906976
RT_VERSION	0x3aae0	0x360	data	0.41087962962962965
RT_MANIFEST	0x3ae40	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:09:13.499167919 CEST	49730	80	192.168.2.4	208.95.112.1
Sep 26, 2024 15:09:13.504267931 CEST	80	49730	208.95.112.1	192.168.2.4
Sep 26, 2024 15:09:13.504375935 CEST	49730	80	192.168.2.4	208.95.112.1
Sep 26, 2024 15:09:13.508593082 CEST	49730	80	192.168.2.4	208.95.112.1
Sep 26, 2024 15:09:13.513535023 CEST	80	49730	208.95.112.1	192.168.2.4
Sep 26, 2024 15:09:13.983155966 CEST	80	49730	208.95.112.1	192.168.2.4
Sep 26, 2024 15:09:14.030062914 CEST	49730	80	192.168.2.4	208.95.112.1
Sep 26, 2024 15:09:19.043636084 CEST	49731	21	192.168.2.4	15.197.240.20
Sep 26, 2024 15:09:19.048504114 CEST	21	49731	15.197.240.20	192.168.2.4
Sep 26, 2024 15:09:19.048583031 CEST	49731	21	192.168.2.4	15.197.240.20
Sep 26, 2024 15:09:19.063138962 CEST	49731	21	192.168.2.4	15.197.240.20
Sep 26, 2024 15:09:19.068216085 CEST	21	49731	15.197.240.20	192.168.2.4
Sep 26, 2024 15:09:19.068284035 CEST	49731	21	192.168.2.4	15.197.240.20
Sep 26, 2024 15:10:06.452294111 CEST	49730	80	192.168.2.4	208.95.112.1
Sep 26, 2024 15:10:06.457595110 CEST	80	49730	208.95.112.1	192.168.2.4
Sep 26, 2024 15:10:06.457653999 CEST	49730	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:09:13.486848116 CEST	50951	53	192.168.2.4	1.1.1.1
Sep 26, 2024 15:09:13.493735075 CEST	53	50951	1.1.1.1	192.168.2.4
Sep 26, 2024 15:09:16.449098110 CEST	63019	53	192.168.2.4	1.1.1.1
Sep 26, 2024 15:09:17.436608076 CEST	63019	53	192.168.2.4	1.1.1.1
Sep 26, 2024 15:09:18.467809916 CEST	63019	53	192.168.2.4	1.1.1.1
Sep 26, 2024 15:09:19.042453051 CEST	53	63019	1.1.1.1	192.168.2.4
Sep 26, 2024 15:09:19.042469978 CEST	53	63019	1.1.1.1	192.168.2.4
Sep 26, 2024 15:09:19.042481899 CEST	53	63019	1.1.1.1	192.168.2.4
Sep 26, 2024 15:09:40.287296057 CEST	53	50785	162.159.36.2	192.168.2.4
Sep 26, 2024 15:09:40.765239000 CEST	64778	53	192.168.2.4	1.1.1.1
Sep 26, 2024 15:09:40.779402018 CEST	53	64778	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 15:09:13.486848116 CEST	192.168.2.4	1.1.1.1	0xe4c1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:16.449098110 CEST	192.168.2.4	1.1.1.1	0x7b8d	Standard query (0)	ftp.antoniomayol.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:17.436608076 CEST	192.168.2.4	1.1.1.1	0x7b8d	Standard query (0)	ftp.antoniomayol.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:18.467809916 CEST	192.168.2.4	1.1.1.1	0x7b8d	Standard query (0)	ftp.antoniomayol.com	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:40.765239000 CEST	192.168.2.4	1.1.1.1	0x5ee4	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 15:09:13.493735075 CEST	1.1.1.1	192.168.2.4	0xe4c1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:19.042453051 CEST	1.1.1.1	192.168.2.4	0x7b8d	No error (0)	ftp.antoniomayol.com		15.197.240.20	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:19.042469978 CEST	1.1.1.1	192.168.2.4	0x7b8d	No error (0)	ftp.antoniomayol.com		15.197.240.20	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:19.042481899 CEST	1.1.1.1	192.168.2.4	0x7b8d	No error (0)	ftp.antoniomayol.com		15.197.240.20	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:09:40.779402018 CEST	1.1.1.1	192.168.2.4	0x5ee4	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	6048	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:09:13.508593082 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 26, 2024 15:09:13.983155966 CEST	175	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:09:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	09:09:09
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\DSR0987678900000.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\DSR0987678900000.exe"
Imagebase:	0x1ebede10000
File size:	3'794'463 bytes
MD5 hash:	780E6F2C7B7D9742A94B9E2DA18B58FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1994968952.000001EB8034D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1995376701.000001EB90811000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:09:12
Start date:	26/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\DSR0987678900000.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:09:12
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:09:12
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0xd80000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4220462335.000000000318E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4220462335.0000000003161000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000003.00000002.4217557146.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:09:13
Start date:	26/09/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 2756 -s 1224
Imagebase:	0x7ff6aac90000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:09:28
Start date:	26/09/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B90EA09 Relevance: 4.1, Strings: 2, Instructions: 1586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

FO_H, xrefs: 00007FFD9B90F662
RO_H, xrefs: 00007FFD9B90EB93

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID: FO_H$RO_H
API String ID: 0-3859653396
Opcode ID: ee3acecffc0b8d6c1c211348b4519640d0ee2c7b9297c48fa162d96980ea6969
Instruction ID: 74794c78c1d0f76ab82c0581c2424e2c16e3725daa3d56187f70d2f2d5ef8314
Opcode Fuzzy Hash: ee3acecffc0b8d6c1c211348b4519640d0ee2c7b9297c48fa162d96980ea6969
Instruction Fuzzy Hash: 2CB29A34A2DB494FD329DB28C4A05B577E2FF96300B1545BEE4CAC32A6DE34E946C781

Function 00007FFD9B9D026B Relevance: 3.2, Strings: 1, Instructions: 1958COMMON

Download Yara Rule

Strings

A, xrefs: 00007FFD9B9D0786

Memory Dump Source

Source File: 00000000.00000002.2002995155.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_DSR0987678900000.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: f9d400638c5e04e4641be026757b1a4c83f01deed3527a004302b3513cae3c45
Instruction ID: 2106072e73e98546f6702fd56acb0082df65f497c5ee7a7c22bc1b672ab6e9bf
Opcode Fuzzy Hash: f9d400638c5e04e4641be026757b1a4c83f01deed3527a004302b3513cae3c45
Instruction Fuzzy Hash: 6BD27B72A1F68D5FE765DB6888755A47BE0FF96700F0603FEE08DCB1A2DA246906C341

Function 00007FFD9B9033D0 Relevance: 2.0, Strings: 1, Instructions: 739
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FFD9B904D5F

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: c512a0036e3add365fb62723ea899ba96cb48ec43418530b1040f68d786e06b9
Instruction ID: fae58c1933621f1c4a2a4b22775be7f438c8138f6b30ff0d87fc51cacfa35552
Opcode Fuzzy Hash: c512a0036e3add365fb62723ea899ba96cb48ec43418530b1040f68d786e06b9
Instruction Fuzzy Hash: 0C229A31B2EA4A5FE728DB6894A16B177E1FF51310B1542BDD49EC72A7DD28F8438380

Function 00007FFD9B9045F0 Relevance: 1.7, Strings: 1, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fish, xrefs: 00007FFD9B904660

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID: fish
API String ID: 0-1064584243
Opcode ID: 6c48f9aba62f7cf4321c597ab856f9544acf70474b4c845a9a3a573ea385166f
Instruction ID: 7d7a4067cd48f438110dcfa94df8fb1b8f8cbc5d67286fd272577fe04377a1e6
Opcode Fuzzy Hash: 6c48f9aba62f7cf4321c597ab856f9544acf70474b4c845a9a3a573ea385166f
Instruction Fuzzy Hash: 63C14935B2DA4E1FE76CAB7898656B573E1EF96310B05417ED4CBC32E3DD18A8428341

Function 00007FFD9B9044A0 Relevance: 1.1, Instructions: 1146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d94ab281a8e4ebbf6550b4beabb4d18cc9fa61923cdfa2a877db68f94827ed
Instruction ID: fc12f65009a687e2edd4f3e7515eb9e86f64ce28e6374b0d03201f7954db9c49
Opcode Fuzzy Hash: e0d94ab281a8e4ebbf6550b4beabb4d18cc9fa61923cdfa2a877db68f94827ed
Instruction Fuzzy Hash: 8782CB31F2E68A5FE7798B1484616B57BE1FF52310F0541BEC48E8B5E3DE28A946C780

Function 00007FFD9B908E60 Relevance: .8, Instructions: 756COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f0bee9bc9283927e7d92786c011e3c9c25dfee515d60dddae9cac89894b4fe
Instruction ID: c65ff1b0c38caca6c175fdce21ff65d490d3bcf92861918370eab32d3c74d023
Opcode Fuzzy Hash: c4f0bee9bc9283927e7d92786c011e3c9c25dfee515d60dddae9cac89894b4fe
Instruction Fuzzy Hash: 2C32F734B1DA0D5FDB78EB6C8465A7977E1EF55300F1501BEE48EC32A2DE24AD428781

Function 00007FFD9B90BAA0 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cef2421689b6084b7c2b6e94a9cb1d853bcc0f248087a3be6763bc5011712da
Instruction ID: 474f2e021553e8837181090e3259c9ac142019ec7abfe00735941265866a5db7
Opcode Fuzzy Hash: 7cef2421689b6084b7c2b6e94a9cb1d853bcc0f248087a3be6763bc5011712da
Instruction Fuzzy Hash: CFC19E3562EB894FE32DCB2984611B5B7E2FF91301B15467ED4CBC32B5DE24A542C781

Function 00007FFD9B914A2B Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d69898233c9754343bfe83af01f2d55def962c1cf51f99141cec852fe514327
Instruction ID: 0488c319b87ee0faaa6704e4ed879d2b289cbf1dd9b4bd1a92d954dad5e9728c
Opcode Fuzzy Hash: 8d69898233c9754343bfe83af01f2d55def962c1cf51f99141cec852fe514327
Instruction Fuzzy Hash: F3516B31B1D74D1FD32D9A7888652A57BE1EB46310B16C2BFD48BC72E7CC24A8078781

Function 00007FFD9B9031B9 Relevance: 1.6, APIs: 1, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B903261

Memory Dump Source

Source File: 00000000.00000002.2002739501.00007FFD9B900000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b900000_DSR0987678900000.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c0cc88cf0c72954811d7431a6a478792d9264c2b5beb63d52d242bbb11f44b3d
Instruction ID: fec7f559dcc024bf4436ed144ea8ab010ad725dfe6925733bf326e1b36464c27
Opcode Fuzzy Hash: c0cc88cf0c72954811d7431a6a478792d9264c2b5beb63d52d242bbb11f44b3d
Instruction Fuzzy Hash: 8C31C731A0CA5C5FDB18DB9CD845AF97BE1EF55321F04426FD049D3192CB646846CB91

Function 00007FFD9B9D10FC Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002995155.00007FFD9B9D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B9D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b9d0000_DSR0987678900000.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee691123b31fefeddfe621905fab375d5de3abffc5fe022660e045ee4597c112
Instruction ID: d8ae97ae22b644c8912087b2ca9169c46e86a128dc9b8bf609b97c9fa91c36bc
Opcode Fuzzy Hash: ee691123b31fefeddfe621905fab375d5de3abffc5fe022660e045ee4597c112
Instruction Fuzzy Hash: 31613B32A1DB8E5FDB65DB6888655A87BF0EF55304B0602BFE44EC71A2DE29A905C340

Analysis Process: AddInProcess32.exePID: 6048, Parent PID: 2756COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.3%
Total number of Nodes:	69
Total number of Limit Nodes:	8

Executed Functions

Function 069A3138 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069A385B
$kq, xrefs: 069A380E
$kq, xrefs: 069A3843
$kq, xrefs: 069A3867
$kq, xrefs: 069A381A
$kq, xrefs: 069A3837

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: efb588e70b0f5764b0dea93c6dc84eca190d2ff152d3156729b436ac424b2761
Instruction ID: 6a882b9ce9587bfbcc7d29b0d6864d287fc315a96fcc68e2c8faa412cf612ffe
Opcode Fuzzy Hash: efb588e70b0f5764b0dea93c6dc84eca190d2ff152d3156729b436ac424b2761
Instruction Fuzzy Hash: 83321E30E1075A8FCB14DF69C99459DB7B6FF99300F2086AAD409A7264EF34AD85CB90

Function 069A7E50 Relevance: 3.0, Strings: 2, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069A81BF
$kq, xrefs: 069A81B3

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 0f28e16dd7a2be6bdc9b246e9bcd857eafd631649f6d7ac1d94ffa8c2c811c39
Instruction ID: 0cebc5b50a54195c6b98722379dbac3f70324156bdb754f9cdf839f8129b0a04
Opcode Fuzzy Hash: 0f28e16dd7a2be6bdc9b246e9bcd857eafd631649f6d7ac1d94ffa8c2c811c39
Instruction Fuzzy Hash: C1028A30B002168FDB54DB69DA846AEB7EAFF84340F248529D4159B7A4DB35EC86CBD0

Function 069A5270 Relevance: 1.9, Strings: 1, Instructions: 602COMMON

Download Yara Rule

Strings

$, xrefs: 069A5969

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 212cfc022bda60cef08288cc3055c4e923145e7a4b3a8e71f33e1d410c85cd40
Instruction ID: 347f9d25e4d4aee5ef46bb2460a9eebb788bdd82e207ef4d6711f4efb2a9fd02
Opcode Fuzzy Hash: 212cfc022bda60cef08288cc3055c4e923145e7a4b3a8e71f33e1d410c85cd40
Instruction Fuzzy Hash: 9E22AD71F003158FDF64DBA9C5806AEBBFAEF84320F268469D406EB694DA35DC45CB90

Function 01717070 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 017170E7

Memory Dump Source

Source File: 00000003.00000002.4220080021.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1710000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: bcf7fffa4e9787328e46e5c776d73e1bffbb27c2e956c5ef7319a52839eadc83
Instruction ID: f46b63c90ebf9b4fd963db69407234e5f2c40f6f0ebf69f49ce2b749f22223d8
Opcode Fuzzy Hash: bcf7fffa4e9787328e46e5c776d73e1bffbb27c2e956c5ef7319a52839eadc83
Instruction Fuzzy Hash: 092137B1900259CFCB14CF9AD484BEEFBF4AF49320F14846AE459B7250D778A944CF65

Function 069A2430 Relevance: 1.0, Instructions: 1010COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73249f8312147fb32c48dac63fe62c2facefe1b997f147ec95367ddacc830ad6
Instruction ID: 9e101c4f875d5c962ac353f16480ca7216971287cd8474628f737e833ace2a73
Opcode Fuzzy Hash: 73249f8312147fb32c48dac63fe62c2facefe1b997f147ec95367ddacc830ad6
Instruction Fuzzy Hash: 13924434E003048FDB64DF68C584A9DBBF6EB45314F6884AAD409EB765DB35EE85CB80

Function 069A66C0 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66214821bc5ebd2bf975bec1a49cb3d256011bc54a941263a3585a0abd03c1d
Instruction ID: c09a4567ebb9bb572b753485d735bd32d29130312d725f278bc4929e81902a44
Opcode Fuzzy Hash: c66214821bc5ebd2bf975bec1a49cb3d256011bc54a941263a3585a0abd03c1d
Instruction Fuzzy Hash: 18628C34B002058FDF54DB68D994AADB7F6EF88314F288469E406DB794DB35ED86CB80

Function 069AC270 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1278d3ab4ea6826ac4854245f788395d3716c4f02bbeaa0ca770021ec5055cd
Instruction ID: 4952dbe267e307201be2561d2d284538c5a816d3ad64341aa40898bd93b88147
Opcode Fuzzy Hash: c1278d3ab4ea6826ac4854245f788395d3716c4f02bbeaa0ca770021ec5055cd
Instruction Fuzzy Hash: BF326D70B10209CFDB54DB69D990AADBBF6FB88310F208529E405EB755DB35EC86CB90

Function 069AB309 Relevance: .6, Instructions: 572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b80b22a7a2e97a074b21bec27d276a8a7cecaa383a96a054aca976a6ca9e7b
Instruction ID: 5f8ce37147106f75f9385688f9a609474b7c20e2046cdbd22c2161a13f70f47a
Opcode Fuzzy Hash: 27b80b22a7a2e97a074b21bec27d276a8a7cecaa383a96a054aca976a6ca9e7b
Instruction Fuzzy Hash: 13226070E002098FDF64CA69C5907AEB7FAFB45310F20852AE409EB799DA35DC85CBD1

Function 069AADB0 Relevance: 10.4, Strings: 8, Instructions: 402
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069AAF7C
$kq, xrefs: 069AAF30
$kq, xrefs: 069AAF5F
$kq, xrefs: 069AAED1
$kq, xrefs: 069AAEDD
$kq, xrefs: 069AAF53
$kq, xrefs: 069AAF24
$kq, xrefs: 069AAF88

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: ee2984a91d2bfdae9c9aed370e1c7fdc5ed73d78786c992c1053b661a84aa8e0
Instruction ID: 354aeb7dc4ff4226cd2e4b097f63cb005b6ea8ce684266cf27eadb16e509e599
Opcode Fuzzy Hash: ee2984a91d2bfdae9c9aed370e1c7fdc5ed73d78786c992c1053b661a84aa8e0
Instruction Fuzzy Hash: DBE16D30E1034A8FCB69DF69D5806AEB7F6FF84304F20852AD4199B758DB359C86CB91

Function 069AB730 Relevance: 8.0, Strings: 6, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069ABCCB
$kq, xrefs: 069ABCA3
$kq, xrefs: 069ABC63
$kq, xrefs: 069ABC97
$kq, xrefs: 069ABC6F
$kq, xrefs: 069ABCD7

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: df0dd8cb8b8c9ed905d67c19d1c3e57fff9e9eda9ee7ad4c513be32fbe0947bc
Instruction ID: 4a6f574d916a2dd275f365865a921f703f65aa4d438017ec99c48f3ccfd311b2
Opcode Fuzzy Hash: df0dd8cb8b8c9ed905d67c19d1c3e57fff9e9eda9ee7ad4c513be32fbe0947bc
Instruction Fuzzy Hash: E0024A70E0020A8FDB64CF68D5807AEB7F6FB85310F20892AD419DBA59DB75DC85CB81

Function 06923A12 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06923A96
GetCurrentThread.KERNEL32 ref: 06923AD3
GetCurrentProcess.KERNEL32 ref: 06923B10
GetCurrentThreadId.KERNEL32 ref: 06923B69

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 67287cad6b3cb8c667fa98ba74a853eb81b03b1ecc25e31e92cecbf5618b53bc
Instruction ID: 4c3dd3a89c29a65372b45a1ac480865c2c507d5d69b7cec90a004b20e8c34d21
Opcode Fuzzy Hash: 67287cad6b3cb8c667fa98ba74a853eb81b03b1ecc25e31e92cecbf5618b53bc
Instruction Fuzzy Hash: 615166B09013098FDB54DFAAD948BEEBBF1FB48314F208069E41AA7660D7349984CF65

Function 06923A18 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06923A96
GetCurrentThread.KERNEL32 ref: 06923AD3
GetCurrentProcess.KERNEL32 ref: 06923B10
GetCurrentThreadId.KERNEL32 ref: 06923B69

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9f5bdb55681c264b02f9aa22ef80cbde55f1821e8cf7c83b17f05a50d17b933f
Instruction ID: f3b0d0a5faf4bc7583e84ed54c3919211dbec3d09ebe186925c5d663512e7261
Opcode Fuzzy Hash: 9f5bdb55681c264b02f9aa22ef80cbde55f1821e8cf7c83b17f05a50d17b933f
Instruction Fuzzy Hash: B85155B09013098FDB54DFAAD948BEEBBF1FB48314F208069E41AA7660D7349984CF65

Function 069A9220 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069A929C
$kq, xrefs: 069A9290
$kq, xrefs: 069A92D7
$kq, xrefs: 069A92CB

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 92a45f9c7e78e622d0b667d43da524bc2a3a911776f45109b306031b9b526336
Instruction ID: 2d97ae4ec6feb69591acca82092045f596dae258fd516b0a102679f1a99c1ba2
Opcode Fuzzy Hash: 92a45f9c7e78e622d0b667d43da524bc2a3a911776f45109b306031b9b526336
Instruction Fuzzy Hash: 3F914E30B1021A8FDB64DF65D9507AEB3FAFF84640F208569C809AB758EF74DC858B90

Function 069AD018 Relevance: 4.5, Strings: 3, Instructions: 799
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069AD40F
$kq, xrefs: 069AD423
$kq, xrefs: 069AD417

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq
API String ID: 0-2086306503
Opcode ID: 8bfdf2b6a8ae8041351f68c9829cda3ffed33e534fe74b9de275e125a1d151b9
Instruction ID: 151075f112e09e66113f3b8395fe39d94a8a54a358141fa1be8150b756a27175
Opcode Fuzzy Hash: 8bfdf2b6a8ae8041351f68c9829cda3ffed33e534fe74b9de275e125a1d151b9
Instruction Fuzzy Hash: 88625E70A102068FCB55DF69D680A5EB7F6FF84314B208A69D0059F768DB75ED8ACBC0

Function 069A4840 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 069A486B
\Opq, xrefs: 069A4A1B
XPpq, xrefs: 069A4991

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: fpq$XPpq$\Opq
API String ID: 0-2571271785
Opcode ID: d1a5ad9b4ef03efb8b1feba43db577ca4686c5745b68aad991cf01c92bd92821
Instruction ID: d62d1987c7f7e4caa741038fdd29bb5a4cddec0295d06a0293a7276f06927b3c
Opcode Fuzzy Hash: d1a5ad9b4ef03efb8b1feba43db577ca4686c5745b68aad991cf01c92bd92821
Instruction Fuzzy Hash: 29617270F003199FEF549FA5C8147AEBAF6FF88700F20842AD506AB794DBB58C458B91

Function 069A9211 Relevance: 2.7, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 069A9290
$kq, xrefs: 069A92CB

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: 82957447d3f42a56e7adf21c70fe3f5b8fef910f754d7f43c250f4336b3e44ed
Instruction ID: 6e9ca9e2767035d0f778c8cbc2965d09b604921cc99790c1e3dc17e600d9f583
Opcode Fuzzy Hash: 82957447d3f42a56e7adf21c70fe3f5b8fef910f754d7f43c250f4336b3e44ed
Instruction Fuzzy Hash: CD514F30B102168FDB54DF69D950B6E77FAFF84690F108469C809DB798EE35DC468B90

Function 069A4831 Relevance: 2.6, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 069A486B
XPpq, xrefs: 069A4991

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: fpq$XPpq
API String ID: 0-1280283
Opcode ID: dd9e759874dfe9a72eb12001dbceda4ea41e8777aea28963adb5b554a72a64c9
Instruction ID: f75d5194c652ed27887e7148abc51fb04e1011c0e21a0f1f6ba13341c459edc3
Opcode Fuzzy Hash: dd9e759874dfe9a72eb12001dbceda4ea41e8777aea28963adb5b554a72a64c9
Instruction Fuzzy Hash: 94518270F003199FDB549FA5C814BAEBAFAFF88700F208529D105AB7A5DAB58C45CB91

Function 0692BF18 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0692C17E

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f0a3d603319fa6f9db2bec762684439dc557a58879271e88a4d6da9ed5b20dd3
Instruction ID: 377285b036c61ceb2b0009207e1058589c3f5b6a74891a59771a8e4428b08803
Opcode Fuzzy Hash: f0a3d603319fa6f9db2bec762684439dc557a58879271e88a4d6da9ed5b20dd3
Instruction Fuzzy Hash: 038178B0A00B168FDBA4DF29D44079ABBF5FF88304F108A2ED44AD7A54D775E845CB90

Function 0171F160 Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4220080021.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1710000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40c276da2631ccede38265592389876c9a22af3526132836f8d4b96a10201b8
Instruction ID: 6ea0d4f173063e21b5adc1015f517712f75741de0e075eed6d04541bd9c0dd0a
Opcode Fuzzy Hash: a40c276da2631ccede38265592389876c9a22af3526132836f8d4b96a10201b8
Instruction Fuzzy Hash: B6412272E0439A8FC714CF79D8146EEBFF5AF89210F1485AAD414E7291DB349845CBE1

Function 0692E104 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0692E222

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 68a482361065859ccfe8215c0c065b7f83c7edd58eace6ddf23c2bf3b66aa02e
Instruction ID: a825005ae5efdf03128497da1693aa554249120fb25a231c2cb839b72cfc36d6
Opcode Fuzzy Hash: 68a482361065859ccfe8215c0c065b7f83c7edd58eace6ddf23c2bf3b66aa02e
Instruction Fuzzy Hash: 1851B0B1D0035A9FDB14CF99C984ADEBBF5BF48310F24862AE819AB214D7719985CF90

Function 0692E110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0692E222

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6376342568ea1fede01908819cc2ca19063d20e2cf02e92c3ac3774e3ef00401
Instruction ID: 98ff7446635c18d38144487999631aa6126920cecbff7f4fc6986d7bfeb11feb
Opcode Fuzzy Hash: 6376342568ea1fede01908819cc2ca19063d20e2cf02e92c3ac3774e3ef00401
Instruction Fuzzy Hash: CF41B0B1D00319DFDB14CF99C984ADEBBF5BF48310F24862AE819AB214D7719985CF90

Function 0171706B Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 017170E7

Memory Dump Source

Source File: 00000003.00000002.4220080021.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1710000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: dc64dfc801c60a163c399ba53e3e4f1655367b34008b42c8850f6b097c7a6302
Instruction ID: 7f92800c0ac3598e4ef3ed4994882d7c033099d3fd60e00081b2f9a90592fe46
Opcode Fuzzy Hash: dc64dfc801c60a163c399ba53e3e4f1655367b34008b42c8850f6b097c7a6302
Instruction Fuzzy Hash: 272148B5900259CFCB14CF9AD484BEEFBF4AF48320F14846AE459B7250D738A944CFA1

Function 06923C58 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06923CE7

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b10a6d290fb7cba7ca28c3877275b0fdee95c1ca1a5b6b9abec25a6ef92599dc
Instruction ID: 69c5705d7c3f67c0bb28ee7f7abe58116322773bb605e1997a84038759f09e2a
Opcode Fuzzy Hash: b10a6d290fb7cba7ca28c3877275b0fdee95c1ca1a5b6b9abec25a6ef92599dc
Instruction Fuzzy Hash: B22107B5D002199FDB10CF9AD985ADEBFF8EB48310F14801AE915A7350D375A940CFA1

Function 06923C60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06923CE7

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 0bd742977506142ef6c5e6590aa3c268efe3c83f2d367d8da4661c917b5f6c48
Instruction ID: 9a39b17501c0ce61acd72be01c438c27e66944c44b359d7972460d98b3bbdaf7
Opcode Fuzzy Hash: 0bd742977506142ef6c5e6590aa3c268efe3c83f2d367d8da4661c917b5f6c48
Instruction Fuzzy Hash: 4B21E4B5D002199FDB10CF9AD984ADEBBF8FB48310F14801AE958A3310D379A940CFA4

Function 0171F248 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0171F2AF

Memory Dump Source

Source File: 00000003.00000002.4220080021.0000000001710000.00000040.00000800.00020000.00000000.sdmp, Offset: 01710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1710000_AddInProcess32.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 3b0b5c1491f2c95dffd53bc5c9cf19ecb8d14b610f688820d005bb1a8c257c00
Instruction ID: f539b2074b1404947cef1241e40d7aa024bd4dd23fc6719804483b32e797ce90
Opcode Fuzzy Hash: 3b0b5c1491f2c95dffd53bc5c9cf19ecb8d14b610f688820d005bb1a8c257c00
Instruction Fuzzy Hash: 9311F3B1C0465A9BCB10DF9AC544BDEFBF4AF48320F14816AD818B7254D378A944CFA5

Function 0692C118 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0692C17E

Memory Dump Source

Source File: 00000003.00000002.4224151347.0000000006920000.00000040.00000800.00020000.00000000.sdmp, Offset: 06920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6920000_AddInProcess32.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: aeadeb1eec4c58395c0e1ca6e7a5a0d4404579458eaa39c75457aa8308299095
Instruction ID: 75755dbe02a5432601885d6dbf0d73870a715a6cd99838b42aafda094774d6a7
Opcode Fuzzy Hash: aeadeb1eec4c58395c0e1ca6e7a5a0d4404579458eaa39c75457aa8308299095
Instruction Fuzzy Hash: AC1102B5C00359CFCB10CF9AC844ADEFBF4AB48314F10852AD459A7610C375A585CFA5

Function 069ADB8D Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

PHkq, xrefs: 069ADCE9

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: e2be0dcef5f6c83cb88b9c277e49c2f86fd70747072073ea94784eca1e10c6c7
Instruction ID: d9b2981d95c29872e1e98020aa7942db4e84fa7469bcf6681e1672baf9989f9c
Opcode Fuzzy Hash: e2be0dcef5f6c83cb88b9c277e49c2f86fd70747072073ea94784eca1e10c6c7
Instruction Fuzzy Hash: EC418170E103499FDF64DF65D54469EBBB6FF85300F20492AE401EBA54DB71984ACB81

Function 069A22A5 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

PHkq, xrefs: 069A23F3

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 66e7d95df9431ebcad5fb6ed89cfc11c1dcc063471e66f8c3efe8ae371fb7798
Instruction ID: 5fa1367739d4ec537b15f8aa47f2515e2e04c0e2eb611723dd2d7ba00f91a5fb
Opcode Fuzzy Hash: 66e7d95df9431ebcad5fb6ed89cfc11c1dcc063471e66f8c3efe8ae371fb7798
Instruction Fuzzy Hash: 3D411130B003418FDB599B34D55466F7BE6EB8A600B28446CD806EB795EF39CD46C7D0

Function 069A22B8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 069A23F3

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 93d875aa0151ffc8b5cd9422f13069ce4f77e07d8da28e3990db248766b4d476
Instruction ID: 6db68a2d5efdd522a6a362ed80896ce7ed387a5f8b69f31ff02deec606446007
Opcode Fuzzy Hash: 93d875aa0151ffc8b5cd9422f13069ce4f77e07d8da28e3990db248766b4d476
Instruction Fuzzy Hash: 10319070B002058FDB589B74D55466F77EBEB8A600B24442CD406DB399EE35DD4687D1

Function 069AFED8 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

|, xrefs: 069AFF38

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 945f47c4a42bb74be17d1e179ed4fb1208010e98ba5e59c33d169cac0e070654
Instruction ID: a92d87cc641060359c12572047155e1526984a2ed3f62ce3c2896012a116f8e9
Opcode Fuzzy Hash: 945f47c4a42bb74be17d1e179ed4fb1208010e98ba5e59c33d169cac0e070654
Instruction Fuzzy Hash: 9E21AC30B042259FDB40DB788808BAE7BF5AF48600F10846DE50ADB3A4EB399D01CB90

Function 069AFEE8 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 069AFF38

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 3c367b1986d1091357c599693aac16d481857fb80c000ca293472bf7dae0e26e
Instruction ID: bbbc15170182e20d102e174260020cddb862efc5ea302235132b0060bd44c084
Opcode Fuzzy Hash: 3c367b1986d1091357c599693aac16d481857fb80c000ca293472bf7dae0e26e
Instruction Fuzzy Hash: 7D118B70F002109FDB40DB789804B6EBBF6AF4C700F10846AE90AEB3A4EA359D00CB80

Function 069A4729 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

\Opq, xrefs: 069A4735

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: \Opq
API String ID: 0-3546586535
Opcode ID: 7e908fd65f06479672eaac145710e415326ad6388878ec4eec35db68d8924b1b
Instruction ID: 16adb30c12d53e1bf5255b2130ea3454eba8fc266028a2b2d6a33d9cd999227f
Opcode Fuzzy Hash: 7e908fd65f06479672eaac145710e415326ad6388878ec4eec35db68d8924b1b
Instruction Fuzzy Hash: 79F0DA70A20269EFDB54DF94E859BAEBBF6BF84A05F200119E402A7694CBB41D45CBC0

Function 069A5EB8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a5ae69c7b80bfa4b36ab3eb700853567f62291abf44c634c94aed7075b6d18
Instruction ID: 6831e2cf91c24e614efb38bb0709b6291073bce4e8100bde4fead453486213b2
Opcode Fuzzy Hash: f4a5ae69c7b80bfa4b36ab3eb700853567f62291abf44c634c94aed7075b6d18
Instruction Fuzzy Hash: 4161D4B1F002214FCF519A7EC88066EBAEBAFD4610B654439E80ADB379DE75DC4287C1

Function 069A4290 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0aaaef8c4329ceebe1753e9c46aa2d947ca5911b1b65cc63099143a6dad714
Instruction ID: 557cf05f3f7eeafb2d9a1de8b7ce28a1cdd4121f802842be1098471daf31acfd
Opcode Fuzzy Hash: db0aaaef8c4329ceebe1753e9c46aa2d947ca5911b1b65cc63099143a6dad714
Instruction Fuzzy Hash: 8E913C30E1021A8FDF60DF68C840B9DB7B5FF89300F2085A9D449AB295DB70AA85CF91

Function 069A3F70 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2047beaf2b5286b3afeadd396111628542a185cb8d5af6f25215269b8e97b6fc
Instruction ID: be3b7679959cc039ea179476748bf41fd981e773159262e6b74c1d9a57b0383f
Opcode Fuzzy Hash: 2047beaf2b5286b3afeadd396111628542a185cb8d5af6f25215269b8e97b6fc
Instruction Fuzzy Hash: 79815F30B0020A8FDF54DFA9D55466EB7F6EF89700F208429D40ADB398EB75DC868B81

Function 069A42A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5d261d2d6680485c1660b6e2ab0507807a0da3c2c2eb21f50502bb6254d5b4
Instruction ID: fa85e867c4185477c16e0e8167daf5d52f1b16243ed00fe46c09472cceebaeb4
Opcode Fuzzy Hash: 3f5d261d2d6680485c1660b6e2ab0507807a0da3c2c2eb21f50502bb6254d5b4
Instruction Fuzzy Hash: 36912C30E1061A8FDF60DF68C980B9DB7B1FF89300F208599D549AB355EB70AA85CF90

Function 069AEBE0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65abb83aecc0c45ea5edc544487553e0d5b69a82433ce0f063678ac468a53f76
Instruction ID: 93da12d802ef3eb13ed72a4db0d33cebe84fe77e3ca1586d5d9b202e0da9dcfe
Opcode Fuzzy Hash: 65abb83aecc0c45ea5edc544487553e0d5b69a82433ce0f063678ac468a53f76
Instruction Fuzzy Hash: 0D711C70A002499FDB54DFA9D980AADBBF6FF88304F248529D419EB755DB30EC46CB90

Function 069AEBF0 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d401a3316125d0521c13ba3b76ebc1aa0afc507ec1c9307a830e35ed05fbb1a6
Instruction ID: 0bb9725dc315105b52711fb88a79519ab95d0d0c35326cfb15bae15b998ecc5c
Opcode Fuzzy Hash: d401a3316125d0521c13ba3b76ebc1aa0afc507ec1c9307a830e35ed05fbb1a6
Instruction Fuzzy Hash: 21711D70A002499FDB54DFA9D980AADBBF6FF88304F248529D419EB755DB30EC45CB90

Function 069AFC78 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66ab601cbd26ecd51d54d826ac6df2c12d567dee5bfd0b9bb0992f817a39dcc
Instruction ID: 36d209654f4874075e737ace94e3a3ac6cf1f59f2f851997a855cfa00a05d272
Opcode Fuzzy Hash: c66ab601cbd26ecd51d54d826ac6df2c12d567dee5bfd0b9bb0992f817a39dcc
Instruction Fuzzy Hash: 5F51C071E01205DFCF24AB78E4446ADBBF6EF84311F20886AE106DB665DB359C55CBC1

Function 069AF622 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09288519009db129de8b342388f27a0f762eb98d76ad5c5425bd8caadeaff82
Instruction ID: c6bf3c455f9403952feb52401e068bbc5b5c91cd50911e01115cf88fe11ff314
Opcode Fuzzy Hash: a09288519009db129de8b342388f27a0f762eb98d76ad5c5425bd8caadeaff82
Instruction Fuzzy Hash: 7E51F8B0B203149FEF65566DD95472F369ED789340F30482AE40AD77A5C979CC8583E2

Function 069A45C8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d29e0c8ee8d800578250de107efacd15fe8a7051b63fd6098b817f0f4a848b
Instruction ID: 01dfb2892131b35986a10885e4f7eb28a080bd17da2c935e3dadadb6e2ffb8dd
Opcode Fuzzy Hash: d2d29e0c8ee8d800578250de107efacd15fe8a7051b63fd6098b817f0f4a848b
Instruction Fuzzy Hash: 9251C430B002049FDB64DB69D984B6EBBEAFB85704F24843AE409DB790CA75DC45CBC1

Function 069AF630 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864f89506532de91c92002dc06c3c0f96d3b07135e0fd84d9ba5c42f45482e7a
Instruction ID: 5491de803a9fd96e901ce518dc5e1a90d9ebaeb6ce16864ff72046f91fcf979f
Opcode Fuzzy Hash: 864f89506532de91c92002dc06c3c0f96d3b07135e0fd84d9ba5c42f45482e7a
Instruction Fuzzy Hash: A551D5B0B203148FEFA4566DD95472F369EE789311F30482AE40AD7BA8D97DCC8583D2

Function 069A50E8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f09da53ef34cfab26fe95e19d113446f1ca1e973fe4338b75ba15e1917c46c
Instruction ID: b22682ffe004215b30c551090308f64c5dc9cf1f4c8568e50899b0ae274645e0
Opcode Fuzzy Hash: 22f09da53ef34cfab26fe95e19d113446f1ca1e973fe4338b75ba15e1917c46c
Instruction Fuzzy Hash: 9A414871F007099FDB60CEA9D880ABFFBF6EB94310F21492AE156D6A54D330E8458BD1

Function 069A45B8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558661c0affdce16ebc28155f7dacb799a99abd75163c11dadb8f7092fc7482
Instruction ID: 07a09b7e4c91a419d87c2117b32f28dac6e4c50a123c1c80f861d102e8831f00
Opcode Fuzzy Hash: d558661c0affdce16ebc28155f7dacb799a99abd75163c11dadb8f7092fc7482
Instruction Fuzzy Hash: 29419D70F102059FDB54DB69D594B6EBBF6EB89704F24842AE00AEB3A0CA75DC45CB81

Function 069A2168 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6c9fdefacce446f3bf6b17594dd3d4637d7fe90b935d83202fdd594d63baf8
Instruction ID: ef794807688e8cc08017d7771b5abfd2c0c0a21865b90f73363b6a6b95df7d00
Opcode Fuzzy Hash: db6c9fdefacce446f3bf6b17594dd3d4637d7fe90b935d83202fdd594d63baf8
Instruction Fuzzy Hash: 70316F30E103059FCB58CF64C4946AEB7F6BF89300F248929E916EBB50DB71AD42CB90

Function 069A2178 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7308c3c9c659dfe20821567c041ed283f2f0d956a811626dae8b49587b008979
Instruction ID: b21f092b1bd94dbb258400134cd7c27d6a654538182f9cc1bfe579639ceebd8b
Opcode Fuzzy Hash: 7308c3c9c659dfe20821567c041ed283f2f0d956a811626dae8b49587b008979
Instruction Fuzzy Hash: 9A313C30E143099BCB18CFA5D4546AEB7F6BF89300F248929E816EB754DB71ED42CB90

Function 069A3B79 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a485b7ad82125fdd73475b2285547c76a8ff9556596ee5c8117add87bfce01c8
Instruction ID: 0c71806879350f3a911ba1e87a45c928d1e9ca3e74adfbe7e76826b34bd67961
Opcode Fuzzy Hash: a485b7ad82125fdd73475b2285547c76a8ff9556596ee5c8117add87bfce01c8
Instruction Fuzzy Hash: 5221D931F002169FDB00CF6AD981AAEBBF1EB48650F108029E901EB390EB35DC858BD0

Function 069A6DD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022de515d95d60b2180407891c6893f5e38ee9616cdb6991a78a59c3cd8879b7
Instruction ID: 2c3ea3ea32fdb478b39dee78f0496210e567ee7f9432e8467fb05191cdb39ba8
Opcode Fuzzy Hash: 022de515d95d60b2180407891c6893f5e38ee9616cdb6991a78a59c3cd8879b7
Instruction Fuzzy Hash: 9121D131B0021A9FCF94DA69ED546AEBBFAEB85354F248039E405DB380DB31DC468BC0

Function 069AA3E0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe57482deee200f429d6830f9a45e7ea4f082a0d7838e3e1bc7071be56e9c407
Instruction ID: 6934c6f60f22e2166e4c212a1247f5c13c0a4a3285ab47f0da478d4e9d4bb62c
Opcode Fuzzy Hash: fe57482deee200f429d6830f9a45e7ea4f082a0d7838e3e1bc7071be56e9c407
Instruction Fuzzy Hash: D0210330B052149FCB55DAB8D8546AE73EAEB8A714B20847AE10AC7750EE36DC42CBD1

Function 069A3B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c83de9f48ac20666e9323ccb9c6b71b038b61d84406f6e18b03ab053e892fc6
Instruction ID: f98088efb080557dff6064b8797d9ae62735f1f9216743f9f7f4dac95c894118
Opcode Fuzzy Hash: 4c83de9f48ac20666e9323ccb9c6b71b038b61d84406f6e18b03ab053e892fc6
Instruction Fuzzy Hash: 09219875F107158FDB44CFAAD981AAEBBF5EB88650F208029E901E7350EB35DC808B90

Function 0147D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4219431680.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aacb61806b1f1a46ad4312b4198dec8e521bf6c7ce9860aca8f36eb4a3573d49
Instruction ID: 305fad05e8d2f510605d004ce62b7cc197801c666c653d48cb3e873a3b3983c0
Opcode Fuzzy Hash: aacb61806b1f1a46ad4312b4198dec8e521bf6c7ce9860aca8f36eb4a3573d49
Instruction Fuzzy Hash: 852125B1904280DFCB16DF58D984B56BFA5EF84318F20C56ED90A4B366C336D447CA61

Function 069A6500 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65baa9ff68cb0a6c0df19249b4fd6d933383906250fc8921f7d59820ab2b163f
Instruction ID: fa08140e8afdf4c8be6bfe3cdf0be94bc538408613e3492a0b3a92fd212ed99a
Opcode Fuzzy Hash: 65baa9ff68cb0a6c0df19249b4fd6d933383906250fc8921f7d59820ab2b163f
Instruction Fuzzy Hash: E8114C3194E3E56FD713AA3C8C2559A3FB88F03104B1A01EBE080CF5A3D559CA4AC3E6

Function 0147D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4219431680.000000000147D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0147D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_147d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96c3d8d28fe2b6f5c3fafba7cec694e4447a0cab58f64c060e179e99aec9a10
Instruction ID: 5bdf06acd6d7ee79e886642930ae8d0e3cd07070ecdd6f493181d98ef05e3b62
Opcode Fuzzy Hash: b96c3d8d28fe2b6f5c3fafba7cec694e4447a0cab58f64c060e179e99aec9a10
Instruction Fuzzy Hash: C3216D755093C08FDB03CF24D994756BF71EF46218F28C5DAD8498B6A7C33A980ACB62

Function 069A3ED0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d000a9b84cde04ca4710a0746e54d8ddb23d8b10b9225d97f21e55bb5bcf061d
Instruction ID: 4def82462c6aa76265c1431c120e4fc8d34683c678fd1a73daf019621e6ce4c2
Opcode Fuzzy Hash: d000a9b84cde04ca4710a0746e54d8ddb23d8b10b9225d97f21e55bb5bcf061d
Instruction Fuzzy Hash: 0101D6307142521FDB21997D980072BB7DACB86624F21843EE109CB795DA21CC0743D1

Function 069A3C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089d768e0ec4a033006cbf22f909f73c79c408d0739f52fda7dc4904c0692ff1
Instruction ID: 3c23f13292449e2bfc953d0384c466935889223211767b3a55037ee337037d3b
Opcode Fuzzy Hash: 089d768e0ec4a033006cbf22f909f73c79c408d0739f52fda7dc4904c0692ff1
Instruction Fuzzy Hash: D411A131B102249FCF549A69DC146AE73FAEBC8650F108539D506EB358EE35DC068BD0

Function 069A3950 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7b674820b7a22a093ef2bdccec2af6578acdd89acbef0bb1d4436a17f9c518
Instruction ID: 45d89a05794eeecd83896aaf88df82daa3af23cdb341c7a644856ca8b922f750
Opcode Fuzzy Hash: 3e7b674820b7a22a093ef2bdccec2af6578acdd89acbef0bb1d4436a17f9c518
Instruction Fuzzy Hash: 2D21C0B5D01219AFCB00DF9AD985ADEFBF8FB48314F10812AE918A7640D374A944CBE5

Function 069AEE5F Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a41afb86a29349bed8c33e0f1dcdee652d4a64dc69cdda597aa55b63672b4680
Instruction ID: 000a94fccc7ef2b85717edb9d2f75ad9796746be72d1f8bcf58c0b3384bfc5de
Opcode Fuzzy Hash: a41afb86a29349bed8c33e0f1dcdee652d4a64dc69cdda597aa55b63672b4680
Instruction Fuzzy Hash: 32018F31B042111BCB619A7CA46073EBBDBDBCAA24F34883AF40AC7795DA26CC4643C1

Function 069A3C89 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1ef5322a7a6acd9f5b4390c1b73f2ca21ba7972bdf3a99e4c0e466a304da67
Instruction ID: 07cb99171610b8636eac957293af2fb6cee685467961bad21b1d41a2fb56a4f6
Opcode Fuzzy Hash: 3e1ef5322a7a6acd9f5b4390c1b73f2ca21ba7972bdf3a99e4c0e466a304da67
Instruction Fuzzy Hash: B401DF32B142254BDF688A79DC146EF77EBEBC8740F24453AD446DB694EE25CC0687D0

Function 069A3958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38afd38bfc9b143df13c6742b3ed82540de2ced08af12066cedc710e9079131a
Instruction ID: 2a6c1c4b825483fae562fda8f5ba2471eed6839e46545eca1bbba17735860a51
Opcode Fuzzy Hash: 38afd38bfc9b143df13c6742b3ed82540de2ced08af12066cedc710e9079131a
Instruction Fuzzy Hash: EB11D3B1D01219DFCB00CF9AD985ADEFBF4FB48314F10812AE918A7200C374A944CFA5

Function 069A3EE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889cbe933c1c1e4ea87b66f90e82830e49c2d37cea20a5c2ccd9dfd6a2864b75
Instruction ID: dfc4186b48052f443782eb7e4ee428799766dc6a73e2598e671aea5b78781818
Opcode Fuzzy Hash: 889cbe933c1c1e4ea87b66f90e82830e49c2d37cea20a5c2ccd9dfd6a2864b75
Instruction Fuzzy Hash: 09016D31B102121BEB64997D985072BA2DEDBC9A24F30883DE20EC7B58EA66DC4243D1

Function 069AEE70 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 032fb41537ba2af5b8c8a3e53014aad3db89b2169ac0cdef7ffc6a4062ae6902
Instruction ID: 9bef42d27731be0a4e9ea8845422f8594098b5d6514cfc1218f1746e1b1e75d5
Opcode Fuzzy Hash: 032fb41537ba2af5b8c8a3e53014aad3db89b2169ac0cdef7ffc6a4062ae6902
Instruction Fuzzy Hash: 17018C31B002115BCB649A7D945073EB7DBDBC9A24F308839E10AC7354EA26DC0643C1

Function 069AA3F0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254189fc631aaefa5d264348a5baa806bc0647101dd4c5822e23985f86a91aba
Instruction ID: ff01517f2598c04b23c18ab0eeecc7e56a2e89c79d2891ba86ff7c941d9163da
Opcode Fuzzy Hash: 254189fc631aaefa5d264348a5baa806bc0647101dd4c5822e23985f86a91aba
Instruction Fuzzy Hash: CF01DC30B002101FCB649A7CE854B2AB3DAEB89B54F20C839E10ACBB54EE21DC4187C1

Non-executed Functions

Function 069A7770 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$kq, xrefs: 069A7CE5
$kq, xrefs: 069A7895
$kq, xrefs: 069A7889
$kq, xrefs: 069A78BA
$kq, xrefs: 069A7D07
$kq, xrefs: 069A7C46
$kq, xrefs: 069A78C6
$kq, xrefs: 069A7CFB
$kq, xrefs: 069A7C52
$kq, xrefs: 069A7CF1

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1324371161
Opcode ID: 86ba40f07c2b5e4a18303b223294bffb926c6b7bcdbb1e0dba2fc23a6079714b
Instruction ID: 8c42b221bff1b1e77d937ab2c2ea96ab934b6dee5c616482d15835371c5b8c0a
Opcode Fuzzy Hash: 86ba40f07c2b5e4a18303b223294bffb926c6b7bcdbb1e0dba2fc23a6079714b
Instruction Fuzzy Hash: F2123C34A003198FDB64DFA9C955AAEB7F6FF84300F20856AD409AB764DB359D85CF80

Function 069AAA18 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$kq, xrefs: 069AAB75
$kq, xrefs: 069AABA0
$kq, xrefs: 069AAB0E
$kq, xrefs: 069AABD6
$kq, xrefs: 069AAB1A
$kq, xrefs: 069AAB69
$kq, xrefs: 069AAB94
$kq, xrefs: 069AABCA

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1078448309
Opcode ID: a2e21539e2abe688e283a0efce605c3af75e633f8ec502ef556053436ebec706
Instruction ID: b84813e273ca72762ea7605e01c5af666c509fc48921be5d1f836de9c62845f6
Opcode Fuzzy Hash: a2e21539e2abe688e283a0efce605c3af75e633f8ec502ef556053436ebec706
Instruction Fuzzy Hash: C8915D30A11309DFEB68DF65D9547AEB7F6BF84301F208529E401976A8DB789C85CBD0

Function 069A7170 Relevance: 7.9, Strings: 6, Instructions: 405COMMON

Download Yara Rule

Strings

$kq, xrefs: 069A74B8
$kq, xrefs: 069A7452
$kq, xrefs: 069A74AC
$kq, xrefs: 069A760C
$kq, xrefs: 069A7678
$kq, xrefs: 069A7684

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-1342094364
Opcode ID: 73be9a5d6d084613edbd2cd80fccd6aa76146c7c386a2b0ba3ad85bc8ad97fb7
Instruction ID: cd01b4c751b683899fcfd5b27af6089d12a8c7e49e3bf88f678faab0f7269ca3
Opcode Fuzzy Hash: 73be9a5d6d084613edbd2cd80fccd6aa76146c7c386a2b0ba3ad85bc8ad97fb7
Instruction Fuzzy Hash: 54F14D34A00209CFDB58DFA9D554A6EBBF6FF84301F248568D4059B768DB39EC86CB81

Function 069A84A8 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$kq, xrefs: 069A8767
$kq, xrefs: 069A8773
$kq, xrefs: 069A870E
$kq, xrefs: 069A8702

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: e05be78d1a0fbda54937a8a8611775889efb1156660e55affa7385fcda3810de
Instruction ID: 2797086497e61c75d8eba176461cd93675db70ed3febcfcbdd1c0df23facf974
Opcode Fuzzy Hash: e05be78d1a0fbda54937a8a8611775889efb1156660e55affa7385fcda3810de
Instruction Fuzzy Hash: B2B10930E102098FDB64EF69D65469EB7F6FF84300F248929D4169B7A8DB75DC86CB80

Function 069A88C0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

$kq, xrefs: 069A893F
LRkq, xrefs: 069A89B3
LRkq, xrefs: 069A8A02
$kq, xrefs: 069A894B

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: LRkq$LRkq$$kq$$kq
API String ID: 0-2392252538
Opcode ID: 31b517c044cdf04bb4acc6b5b5b1fbcc687b1397b8457f68edef38d14f31be98
Instruction ID: ac54e5d42baea4911936a4fe0634aac09651b2e3a260cc2ccac6c3335790d6f7
Opcode Fuzzy Hash: 31b517c044cdf04bb4acc6b5b5b1fbcc687b1397b8457f68edef38d14f31be98
Instruction Fuzzy Hash: A651C230B003069FDB58DF69DA40A6AB7EAFF88310F248569D4059B7A5DB34EC85CBD1

Function 069AADAA Relevance: 5.2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

Strings

$kq, xrefs: 069AAF7C
$kq, xrefs: 069AAED1
$kq, xrefs: 069AAF53
$kq, xrefs: 069AAF24

Memory Dump Source

Source File: 00000003.00000002.4224622767.00000000069A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_69a0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $kq$$kq$$kq$$kq
API String ID: 0-2881790790
Opcode ID: 466df0d597ca24c9faaddd816684c671ccfceeb5f0c56ea9412fc68ac348b12a
Instruction ID: ccb2738457d363919dc3f87676280c50f481916bc7bf31891b606881964fda4d
Opcode Fuzzy Hash: 466df0d597ca24c9faaddd816684c671ccfceeb5f0c56ea9412fc68ac348b12a
Instruction Fuzzy Hash: E9518F70A102059FDF69DA69D5806AEB3F6EB84310F30892AE406D7B54DB39EC85CBD0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DSR0987678900000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_DSR0987678900000_7e74b1b87155529a3ff0bd98fc2c8d3a6c378e49_a7480bc7_055a7e94-47cf-4121-8aa6-26f4dc22353a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1637.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER16A6.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA6F.tmp.dmp

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4ti4kez.vbv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ka5pv3g1.2pp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ljiicu1b.ymn.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rdt4hkkt.11g.psm1

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
DSR0987678900000.exe

Function 00007FFD9B90EA09 Relevance: 4.1, Strings: 2, Instructions: 1586
COMMON

Function 00007FFD9B9033D0 Relevance: 2.0, Strings: 1, Instructions: 739
COMMON

Function 00007FFD9B9045F0 Relevance: 1.7, Strings: 1, Instructions: 454
COMMON

Function 00007FFD9B9031B9 Relevance: 1.6, APIs: 1, Instructions: 121
memoryCOMMON

Function 069A3138 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Function 069A7E50 Relevance: 3.0, Strings: 2, Instructions: 478
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre