Windows Analysis Report
Quotation____________________________________pdf.exe

Overview

General Information

Sample name:	Quotation____________________________________pdf.exe
Analysis ID:	1592060
MD5:	ac380ebb31729e7fed32dc97d011f7f7
SHA1:	2ce4e333861a1b846a0ae5342deebb2de7d5bc4a
SHA256:	5d4dc700ab772bfb4ac1fa290c0dfeae62058d31c42b48b5072a2c13b4c419bb
Tags:	DarkCloudexeuser-threatcat_ch
Infos:

Detection

DarkCloud

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected DarkCloud

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Initial sample is a PE file and has a suspicious name

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes or reads registry keys via WMI

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
DarkCloud Stealer	Stealer is written in Visual Basic.	No Attribution	https://asec.ahnlab.com/en/53128/ https://c3rb3ru5d3d53c.github.io/malware-blog/darkcloud-stealer/	https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Quotation____________________________________pdf.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe

Avira: detection malicious, Label: HEUR/AGEN.1311126

Found malware configuration

Source: 2.2.Quotation____________________________________pdf.exe.4cb9990.1.raw.unpack

Malware Configuration Extractor: DarkCloud {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8181099166:AAHWiTz10g_-_BPRNk3yroxe3fl_IXTpU7s/sendMessage?chat_id=6250686237"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Virustotal: Detection: 54%			Perma Link

Multi AV Scanner detection for submitted file

Source: Quotation____________________________________pdf.exe	Virustotal: Detection: 54%			Perma Link
Source: Quotation____________________________________pdf.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Quotation____________________________________pdf.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Cookies
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \Default\Login Data
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \Login Data
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: //setting[@name='Password']/value
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Password :
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Software\Martin Prikryl\WinSCP 2\Sessions
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: SMTP Email Address
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: NNTP Email Address
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Email
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: HTTPMail User Name
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: HTTPMail Server
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(?!:\/\/)([a-zA-Z0-9-_]+\.)[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Password
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^3[47][0-9]{13}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(6541\|6556)[0-9]{12}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^389[0-9]{11}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^3(?:0[0-5]\|[68][0-9])[0-9]{11}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^63[7-9][0-9]{13}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(?:2131\|1800\|35\\d{3})\\d{11}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^9[0-9]{15}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(6304\|6706\|6709\|6771)[0-9]{12,15}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Visa Card
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(5018\|5020\|5038\|6304\|6759\|6761\|6763)[0-9]{8,15}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Mastercard
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(6334\|6767)[0-9]{12}\|(6334\|6767)[0-9]{14}\|(6334\|6767)[0-9]{15}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{12}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{14}\|(4903\|4905\|4911\|4936\|6333\|6759)[0-9]{15}\|564182[0-9]{10}\|564182[0-9]{12}\|564182[0-9]{13}\|633110[0-9]{10}\|633110[0-9]{12}\|633110[0-9]{13}$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(62[0-9]{14,17})$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: ^(?:4[0-9]{12}(?:[0-9]{3})?\|5[1-5][0-9]{14})$
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Visa Master Card
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \logins.json
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \signons.sqlite
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Foxmail.exe
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: mail\
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \Accounts\Account.rec0
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: \AccCfg\Accounts.tdat
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: EnableSignature
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: Application : FoxMail
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: encryptedUsername
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: logins
Source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack	String decryptor: encryptedPassword

Uses 32bit PE files

Source: Quotation____________________________________pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Quotation____________________________________pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: W.pdb4 source: Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004CEF000.00000004.00000800.00020000.00000000.sdmp, Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004D22000.00000004.00000800.00020000.00000000.sdmp, Quotation____________________________________pdf.exe, 0000000D.00000002.2518251668.000000000045A000.00000040.00000400.00020000.00000000.sdmp

Source: Quotation____________________________________pdf.exe, 00000002.00000002.1289601046.00000000034E8000.00000004.00000800.00020000.00000000.sdmp, qlOtJNH.exe, 0000000E.00000002.1313200349.0000000002DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Quotation____________________________________pdf.exe, Quotation____________________________________pdf.exe, 0000000D.00000002.2518251668.0000000000401000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.1290158620.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: Quotation____________________________________pdf.exe
Source: initial sample	Static PE information: Filename: Quotation____________________________________pdf.exe

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::enumvalues
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::getstringvalue
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::EnumKey

Detected potential crypto function

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_032A4224	2_2_032A4224
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_032A7D4F	2_2_032A7D4F
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD05B0	2_2_07AD05B0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD44C8	2_2_07AD44C8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD63E0	2_2_07AD63E0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4088	2_2_07AD4088
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD5B30	2_2_07AD5B30
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4703	2_2_07AD4703
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4710	2_2_07AD4710
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD05A0	2_2_07AD05A0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD35E8	2_2_07AD35E8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD35F8	2_2_07AD35F8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD44BB	2_2_07AD44BB
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADF498	2_2_07ADF498
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD23A8	2_2_07AD23A8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD23B8	2_2_07AD23B8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD63D3	2_2_07AD63D3
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADE090	2_2_07ADE090
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD50C0	2_2_07AD50C0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD0006	2_2_07AD0006
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD407B	2_2_07AD407B
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD0040	2_2_07AD0040
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD2F68	2_2_07AD2F68
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD2F59	2_2_07AD2F59
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4EA0	2_2_07AD4EA0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4EB0	2_2_07AD4EB0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADDC49	2_2_07ADDC49
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD5B23	2_2_07AD5B23
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD3A81	2_2_07AD3A81
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD3A90	2_2_07AD3A90
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4A68	2_2_07AD4A68
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD4A58	2_2_07AD4A58
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD69B8	2_2_07AD69B8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD69C8	2_2_07AD69C8
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADF8C0	2_2_07ADF8C0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADF8D0	2_2_07ADF8D0
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD3808	2_2_07AD3808
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07AD3818	2_2_07AD3818
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 2_2_07ADD813	2_2_07ADD813
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 13_2_00407434	13_2_00407434
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Code function: 13_2_00407490	13_2_00407490
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_01414224	14_2_01414224
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_01417D4F	14_2_01417D4F
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601F400	14_2_0601F400
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_060180B8	14_2_060180B8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601FB58	14_2_0601FB58
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601E888	14_2_0601E888
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_060185B2	14_2_060185B2
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_060112E8	14_2_060112E8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_060112F8	14_2_060112F8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601F3E7	14_2_0601F3E7
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601E8C1	14_2_0601E8C1
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078605B0	14_2_078605B0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078644C8	14_2_078644C8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864088	14_2_07864088
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07865B30	14_2_07865B30
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864702	14_2_07864702
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864710	14_2_07864710
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078605A0	14_2_078605A0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078635E8	14_2_078635E8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078635F8	14_2_078635F8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786F498	14_2_0786F498
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078644B8	14_2_078644B8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864446	14_2_07864446
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078623A8	14_2_078623A8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078623B8	14_2_078623B8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078663D2	14_2_078663D2
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078663E0	14_2_078663E0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786E090	14_2_0786E090
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07860007	14_2_07860007
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07860040	14_2_07860040
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786407A	14_2_0786407A
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07862F59	14_2_07862F59
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07862F68	14_2_07862F68
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864EA0	14_2_07864EA0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864EB0	14_2_07864EB0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786DC49	14_2_0786DC49
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07865B22	14_2_07865B22
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07863A81	14_2_07863A81
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07863A90	14_2_07863A90
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864A58	14_2_07864A58
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07864A68	14_2_07864A68
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078669B8	14_2_078669B8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_078669C8	14_2_078669C8
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786F8C0	14_2_0786F8C0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786F8D0	14_2_0786F8D0
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07863808	14_2_07863808
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0786D812	14_2_0786D812
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_07863818	14_2_07863818

Sample file is different than original file name gathered from version info

Source: Quotation____________________________________pdf.exe, 00000002.00000002.1295762170.0000000007A10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000002.1288570530.000000000172E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000002.1296766051.000000000A8D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004CEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefowling.exe vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefowling.exe vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004D22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe, 00000002.00000000.1267792803.0000000000F12000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamevaRq.exe< vs Quotation____________________________________pdf.exe
Source: Quotation____________________________________pdf.exe	Binary or memory string: OriginalFilenamevaRq.exe< vs Quotation____________________________________pdf.exe

Uses 32bit PE files

Source: Quotation____________________________________pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: 00000002.00000002.1290158620.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: Quotation____________________________________pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: qlOtJNH.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004D22000.00000004.00000800.00020000.00000000.sdmp, Quotation____________________________________pdf.exe, 00000002.00000002.1290158620.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp, Quotation____________________________________pdf.exe, 0000000D.00000002.2518251668.0000000000401000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ,@PC*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: Quotation____________________________________pdf.exe	Binary or memory string: C*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: qlOtJNH.exe	Binary or memory string: *\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp
Source: Quotation____________________________________pdf.exe, 0000000D.00000002.2518251668.0000000000435000.00000040.00000400.00020000.00000000.sdmp, qlOtJNH.exe, 00000012.00000002.2518175365.0000000000428000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: ;@*\AC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\Stub\Project1.vbp Wj

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/13@0/0

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe

File created: C:\Users\user\AppData\Roaming\qlOtJNH.exe

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2064:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03

Source: Quotation____________________________________pdf.exe	Binary or memory string: SELECT item1 FROM metadata WHERE id = 'password';
Source: LogfirelessHrvQSXEgnfSYYboorishly.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\Quotation____________________________________pdf.exe "C:\Users\user\Desktop\Quotation____________________________________pdf.exe"
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qlOtJNH.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qlOtJNH" /XML "C:\Users\user\AppData\Local\Temp\tmp85B3.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Users\user\Desktop\Quotation____________________________________pdf.exe "C:\Users\user\Desktop\Quotation____________________________________pdf.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\qlOtJNH.exe C:\Users\user\AppData\Roaming\qlOtJNH.exe
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qlOtJNH" /XML "C:\Users\user\AppData\Local\Temp\tmp8F48.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Process created: C:\Users\user\AppData\Roaming\qlOtJNH.exe "C:\Users\user\AppData\Roaming\qlOtJNH.exe"
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Process created: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\qlOtJNH.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qlOtJNH" /XML "C:\Users\user\AppData\Local\Temp\tmp85B3.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Process created: C:\Users\user\Desktop\Quotation____________________________________pdf.exe "C:\Users\user\Desktop\Quotation____________________________________pdf.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qlOtJNH" /XML "C:\Users\user\AppData\Local\Temp\tmp8F48.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Process created: C:\Users\user\AppData\Roaming\qlOtJNH.exe "C:\Users\user\AppData\Roaming\qlOtJNH.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	Section loaded: esscli.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_06011B02 push 840534A5h; iretd		14_2_06011B0D
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Code function: 14_2_0601EBFB push ecx; ret		14_2_0601EBFC

Source: Quotation____________________________________pdf.exe	Static PE information: section name: .text entropy: 7.742974670485865
Source: qlOtJNH.exe.2.dr	Static PE information: section name: .text entropy: 7.742974670485865

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 3260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 34B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 8350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 7C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: 9350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: A350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: A980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Memory allocated: B980000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 2D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 4D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 79B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 89B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 8B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: 9B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: A2B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Memory allocated: B2B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6894			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2594			Jump to behavior

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe TID: 5680	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe TID: 7320	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: WebData.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: WebData.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: WebData.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: WebData.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: WebData.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: WebData.13.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: WebData.13.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: WebData.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: WebData.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: WebData.13.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: WebData.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: WebData.13.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: WebData.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: WebData.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: WebData.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: WebData.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: WebData.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: WebData.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Queries volume information: C:\Users\user\Desktop\Quotation____________________________________pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Quotation____________________________________pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Queries volume information: C:\Users\user\AppData\Roaming\qlOtJNH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4cb9990.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4fc7ad8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4cb9990.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4fc7ad8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4ffe408.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Quotation____________________________________pdf.exe.4dd2108.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1290158620.0000000004CB9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2518251668.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1290158620.0000000004D22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Quotation____________________________________pdf.exe PID: 2000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Quotation____________________________________pdf.exe PID: 7264, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\qlOtJNH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

ID:	1592060
Product:	CloudBasic
Start time:	18:02:07
Start date:	15.01.2025
Sample:	Quotation____________________________________pdf.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ac380ebb31729e7fed32dc97d011f7f7
SHA1:	2ce4e333861a1b846a0ae5342deebb2de7d5bc4a
SHA256:	5d4dc700ab772bfb4ac1fa290c0dfeae62058d31c42b48b5072a2c13b4c419bb
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quotation____________________________________pdf.exe.log	ASCII text, with CRLF line terminators	1330C80CAAC9A0FB172F202485E9B1E8	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qlOtJNH.exe.log	ASCII text, with CRLF line terminators	1330C80CAAC9A0FB172F202485E9B1E8	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	CAAF9E85F4215DFF27856092092AD361	F9CDD4D9D1C22BAE6BAAC86BFD85A82AA22D9CA9	85B3FC09907CF6D617498E0051E9B0C07FB195ADB8478F46082ED71FB8722C04
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2neaqg3y.rqr.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfuj3qit.beh.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w4ylfoxl.jok.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnmlsegf.02g.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\tmp85B3.tmp	XML 1.0 document, ASCII text	B4464E21850754E373D9F36643578971	C48B83EACEB6A130DD37C5342F513FE1FE89F647	D775C45EA9B084E3E60A145E3C3407754CA167F8D158AE8E0F38091E3990600D
C:\Users\user\AppData\Local\Temp\tmp8F48.tmp	XML 1.0 document, ASCII text	B4464E21850754E373D9F36643578971	C48B83EACEB6A130DD37C5342F513FE1FE89F647	D775C45EA9B084E3E60A145E3C3407754CA167F8D158AE8E0F38091E3990600D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\LogfirelessHrvQSXEgnfSYYboorishly	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\user-PC-user\WebData	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7	9A809AD8B1FDDA60760BB6253358A1DB	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
C:\Users\user\AppData\Roaming\qlOtJNH.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	AC380EBB31729E7FED32DC97D011F7F7	2CE4E333861A1B846A0AE5342DEEBB2DE7D5BC4A	5D4DC700AB772BFB4AC1FA290C0DFEAE62058D31C42B48B5072A2C13B4C419BB
C:\Users\user\AppData\Roaming\qlOtJNH.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309

Windows Analysis Report Quotation____________________________________pdf.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Quotation____________________________________pdf.exe

Malware Threat Intel
Provided by