Windows Analysis Report
random.exe

Overview

General Information

Sample name: random.exe
Analysis ID: 1592066
MD5: e2e13615dffaff99a1d0cd9d32c4cf80
SHA1: 6b804aad52f0dfda2303dde5c0e641bb20f14fc2
SHA256: 71cfdbe5a32fb5cb2a5eff926c8b9000b231f4990b258872e7cf3a0e4c46bccf
Tags: exemalwaretrojanuser-Joker
Infos:

Detection

LiteHTTP Bot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LiteHTTP Bot
AI detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Protects its processes via BreakOnTermination flag
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Self deletion via cmd or bat file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: random.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\random.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\microsoft.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\autoit3.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\java.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\jdownloader.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\internet explorer.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\msecache.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\common files.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\mozilla maintenance service.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\reference assemblies.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\microsoft.net.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\google.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\microsoft office.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Source: C:\Users\user\OneDrive\msbuild.exe Avira: detection malicious, Label: HEUR/AGEN.1351936
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Roaming\random.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\autoit3.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\common files.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\google.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\internet explorer.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\java.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\jdownloader.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\microsoft office.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\microsoft.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\microsoft.net.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\mozilla maintenance service.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\msbuild.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\msecache.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\reference assemblies.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows defender.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows mail.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows media player.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows multimedia platform.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows nt.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows photo viewer.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows portable devices.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windows sidebar.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\OneDrive\windowspowershell.exe ReversingLabs: Detection: 21%
Multi AV Scanner detection for submitted file
Source: random.exe ReversingLabs: Detection: 21%
Source: random.exe Virustotal: Detection: 31% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\random.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\microsoft.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\autoit3.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\java.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\jdownloader.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\internet explorer.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\msecache.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\common files.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\mozilla maintenance service.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\reference assemblies.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\microsoft.net.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\google.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\microsoft office.exe Joe Sandbox ML: detected
Source: C:\Users\user\OneDrive\msbuild.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: random.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.9:59241 version: TLS 1.2
Source: random.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\Badus\OneDrive\Desktop\Bot1.0.7\Bot\LiteHTTP\obj\Debug\Anubis.pdb source: random.exe, windows photo viewer.exe.1.dr, windows nt.exe.1.dr, windows sidebar.exe.1.dr, random.exe.1.dr, microsoft.exe.1.dr, autoit3.exe.1.dr, java.exe.1.dr, windows mail.exe.1.dr, windowspowershell.exe.1.dr, jdownloader.exe.1.dr, internet explorer.exe.1.dr, msecache.exe.1.dr, common files.exe.1.dr, windows multimedia platform.exe.1.dr, mozilla maintenance service.exe.1.dr, windows defender.exe.1.dr, reference assemblies.exe.1.dr, windows media player.exe.1.dr, microsoft.net.exe.1.dr, mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe.1.dr, cEp3d38.exe.1.dr, google.exe.1.dr, microsoft office.exe.1.dr, msbuild.exe.1.dr, windows portable devices.exe.1.dr
Source: Binary string: C:\Users\Badus\OneDrive\Desktop\Bot1.0.7\Bot\LiteHTTP\obj\Debug\Anubis.pdbd source: random.exe, windows photo viewer.exe.1.dr, windows nt.exe.1.dr, windows sidebar.exe.1.dr, random.exe.1.dr, microsoft.exe.1.dr, autoit3.exe.1.dr, java.exe.1.dr, windows mail.exe.1.dr, windowspowershell.exe.1.dr, jdownloader.exe.1.dr, internet explorer.exe.1.dr, msecache.exe.1.dr, common files.exe.1.dr, windows multimedia platform.exe.1.dr, mozilla maintenance service.exe.1.dr, windows defender.exe.1.dr, reference assemblies.exe.1.dr, windows media player.exe.1.dr, microsoft.net.exe.1.dr, mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe.1.dr, cEp3d38.exe.1.dr, google.exe.1.dr, microsoft office.exe.1.dr, msbuild.exe.1.dr, windows portable devices.exe.1.dr
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\random.exe Code function: 4x nop then jmp 01512EBEh 1_2_01512DE8
Source: C:\Users\user\Desktop\random.exe Code function: 4x nop then jmp 01512FECh 1_2_01512FE0
Source: C:\Users\user\Desktop\random.exe Code function: 4x nop then jmp 01512FECh 1_2_01512ED8
Source: C:\Users\user\Desktop\random.exe Code function: 4x nop then jmp 01512FECh 1_2_01512EC7

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2830238 - Severity 1 - ETPRO MALWARE Observed LiteHTTP Bot Default User-Agent : 192.168.2.9:59239 -> 87.120.126.5:80
Source: Network traffic Suricata IDS: 2819705 - Severity 1 - ETPRO MALWARE MSIL/LiteHTTP Bot CnC Checkin : 192.168.2.9:59239 -> 87.120.126.5:80
Source: Network traffic Suricata IDS: 2829909 - Severity 1 - ETPRO MALWARE LiteHTTP Bot CnC Checkin M2 : 192.168.2.9:59239 -> 87.120.126.5:80
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.9:59230 -> 162.159.36.2:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dl/19480319/anubis.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dl/19480319/anubis.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.21.16 104.21.21.16
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown TCP traffic detected without corresponding DNS query: 87.120.126.5
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /dl/19480319/anubis.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /dl/19480319/anubis.exe HTTP/1.1Host: tmpfiles.orgConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: tmpfiles.org
Source: unknown HTTP traffic detected: POST /VmCetSC7/page.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: E9BC3BD76216AFA560BFB5ACAF5731A3Host: 87.120.126.5Content-Length: 367Expect: 100-continueConnection: Keep-Alive
Source: random.exe, 00000001.00000002.2008201035.000000000339F000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.00000000033A7000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.00000000032CD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.126.5
Source: random.exe, 00000001.00000002.2008201035.0000000003098000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.126.5/VmCetSC7/page.php
Source: random.exe, 00000001.00000002.2008201035.000000000339F000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.00000000031A2000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.00000000033A7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://87.120.126.5/VmCetSC7/page.phpP
Source: random.exe, 00000001.00000002.2008201035.00000000031A2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: random.exe, 00000001.00000002.2008201035.0000000003365000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.0000000003326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.0000000003315000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tmpfiles.org
Source: random.exe, 00000001.00000002.2008201035.0000000003315000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tmpfiles.org/dl/19480319/anubis.exe
Source: random.exe, 00000001.00000002.2008201035.0000000003365000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.0000000003326000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tmpfiles.orgd
Source: random.exe, 00000001.00000002.2008201035.0000000003365000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tmpfiles.org
Source: random.exe, 00000001.00000002.2008201035.0000000003365000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.0000000003326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000001.00000002.2008201035.00000000032E3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://tmpfiles.org/dl/19480319/anubis.exe
Source: unknown Network traffic detected: HTTP traffic on port 59241 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 59241
Source: unknown HTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.9:59241 version: TLS 1.2

Operating System Destruction
barindex
Protects its processes via BreakOnTermination flag
Source: C:\Users\user\Desktop\random.exe Process information set: 01 00 00 00 Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: random.exe, type: SAMPLE Matched rule: Detects CoreBot Author: ditekSHen
Source: 1.0.random.exe.cf0000.0.unpack, type: UNPACKEDPE Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\jdownloader.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows multimedia platform.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\autoit3.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windowspowershell.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\reference assemblies.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows mail.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\common files.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\microsoft.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows defender.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows sidebar.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows photo viewer.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\msecache.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\java.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\internet explorer.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\mozilla maintenance service.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows nt.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\random.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\microsoft.net.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows media player.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\google.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\microsoft office.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\windows portable devices.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\OneDrive\msbuild.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe, type: DROPPED Matched rule: Detects CoreBot Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_01513010 1_2_01513010
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_01511390 1_2_01511390
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_0151E970 1_2_0151E970
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_055375D8 1_2_055375D8
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_0553F698 1_2_0553F698
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_05538828 1_2_05538828
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_05531298 1_2_05531298
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_05531AB8 1_2_05531AB8
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_05531AA9 1_2_05531AA9
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B51278 1_2_06B51278
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B54788 1_2_06B54788
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B53918 1_2_06B53918
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B534DF 1_2_06B534DF
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B50040 1_2_06B50040
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_06B53550 1_2_06B53550
Sample file is different than original file name gathered from version info
Source: random.exe, 00000001.00000002.2007218382.00000000012EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs random.exe
Source: random.exe, 00000001.00000002.2010343903.00000000069B9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Source: random.exe, 00000001.00000000.1340305502.0000000000CFC000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Source: random.exe, 00000001.00000002.2007218382.0000000001344000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Source: random.exe, 00000001.00000002.2008201035.000000000338F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Source: random.exe Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Source: random.exe.1.dr Binary or memory string: OriginalFilenameAnubis.exeD vs random.exe
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: random.exe, type: SAMPLE Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: 1.0.random.exe.cf0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\jdownloader.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows multimedia platform.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\autoit3.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windowspowershell.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\reference assemblies.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows mail.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\common files.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\microsoft.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows defender.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows sidebar.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows photo viewer.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\msecache.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\java.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\internet explorer.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\mozilla maintenance service.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows nt.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\AppData\Roaming\random.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\microsoft.net.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows media player.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\google.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\microsoft office.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\windows portable devices.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\OneDrive\msbuild.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe, type: DROPPED Matched rule: MALWARE_Win_CoreBot author = ditekSHen, description = Detects CoreBot, snort_sid = 920211-920212
Source: classification engine Classification label: mal100.troj.evad.winEXE@14/52@1/2
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Roaming\random.exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:744:120:WilError_03
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03
Source: random.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\random.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\random.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: random.exe ReversingLabs: Detection: 21%
Source: random.exe Virustotal: Detection: 31%
Source: C:\Users\user\Desktop\random.exe File read: C:\Users\user\Desktop\random.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /Create /SC ONLOGON /TN "TaskHelper" /TR "C:\Users\user\Desktop\random.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Users\user\Desktop\random.exe C:\Users\user\Desktop\random.exe
Source: unknown Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: unknown Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Roaming\cEp3d38.exe "C:\Users\user\AppData\Roaming\cEp3d38.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /Create /SC ONLOGON /TN "TaskHelper" /TR "C:\Users\user\Desktop\random.exe" /F Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Roaming\cEp3d38.exe "C:\Users\user\AppData\Roaming\cEp3d38.exe" Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32 Jump to behavior
Source: random.lnk.1.dr LNK file: ..\..\..\..\..\..\..\Desktop\random.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: random.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: random.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\Badus\OneDrive\Desktop\Bot1.0.7\Bot\LiteHTTP\obj\Debug\Anubis.pdb source: random.exe, windows photo viewer.exe.1.dr, windows nt.exe.1.dr, windows sidebar.exe.1.dr, random.exe.1.dr, microsoft.exe.1.dr, autoit3.exe.1.dr, java.exe.1.dr, windows mail.exe.1.dr, windowspowershell.exe.1.dr, jdownloader.exe.1.dr, internet explorer.exe.1.dr, msecache.exe.1.dr, common files.exe.1.dr, windows multimedia platform.exe.1.dr, mozilla maintenance service.exe.1.dr, windows defender.exe.1.dr, reference assemblies.exe.1.dr, windows media player.exe.1.dr, microsoft.net.exe.1.dr, mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe.1.dr, cEp3d38.exe.1.dr, google.exe.1.dr, microsoft office.exe.1.dr, msbuild.exe.1.dr, windows portable devices.exe.1.dr
Source: Binary string: C:\Users\Badus\OneDrive\Desktop\Bot1.0.7\Bot\LiteHTTP\obj\Debug\Anubis.pdbd source: random.exe, windows photo viewer.exe.1.dr, windows nt.exe.1.dr, windows sidebar.exe.1.dr, random.exe.1.dr, microsoft.exe.1.dr, autoit3.exe.1.dr, java.exe.1.dr, windows mail.exe.1.dr, windowspowershell.exe.1.dr, jdownloader.exe.1.dr, internet explorer.exe.1.dr, msecache.exe.1.dr, common files.exe.1.dr, windows multimedia platform.exe.1.dr, mozilla maintenance service.exe.1.dr, windows defender.exe.1.dr, reference assemblies.exe.1.dr, windows media player.exe.1.dr, microsoft.net.exe.1.dr, mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe.1.dr, cEp3d38.exe.1.dr, google.exe.1.dr, microsoft office.exe.1.dr, msbuild.exe.1.dr, windows portable devices.exe.1.dr
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_01517300 pushfd ; retn 0147h 1_2_01517379
Source: C:\Users\user\Desktop\random.exe Code function: 1_2_01518C80 push eax; ret 1_2_01518E17
Drops PE files
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\common files.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\mozilla maintenance service.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows mail.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows sidebar.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Roaming\random.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows nt.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows media player.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\reference assemblies.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows multimedia platform.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\java.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Roaming\cEp3d38.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\jdownloader.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\autoit3.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows portable devices.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\msecache.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windowspowershell.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\microsoft.net.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows photo viewer.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\microsoft office.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\windows defender.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\microsoft.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\google.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\internet explorer.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\OneDrive\msbuild.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /Create /SC ONLOGON /TN "TaskHelper" /TR "C:\Users\user\Desktop\random.exe" /F
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\random.lnk Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\random.lnk Jump to behavior
Source: C:\Users\user\Desktop\random.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run TaskHelper Jump to behavior
Source: C:\Users\user\Desktop\random.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run TaskHelper Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\random.exe Process created: "cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe Process created: "cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe" Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive
Uses ping.exe to sleep
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000 Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\random.exe Memory allocated: 1510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 3090000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 16B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 1160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 2EA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 12D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: A40000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 2360000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 4360000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: B30000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: 2680000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: CA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Memory allocated: 7F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Memory allocated: 2430000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Memory allocated: 2380000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 2543 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 7261 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 2271 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 7543 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 4906 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 4902 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 1646 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window / User API: threadDelayed 431 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Window / User API: threadDelayed 1454 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35048813740048126s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39705s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39580s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39455s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39330s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -39080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38955s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38829s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38705s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38580s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38455s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38330s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -38165s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37911s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37798s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37673s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37549s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37423s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37298s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37173s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -37048s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36923s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36798s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36673s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36548s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36423s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36298s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36173s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -36048s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35923s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35799s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35673s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35548s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35376s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35252s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -35080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34935s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34705s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34580s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34455s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34330s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -34080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33955s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33705s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33580s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33455s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33330s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 3920 Thread sleep time: -33205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -32281802128991695s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39705s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39580s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39455s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39330s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39205s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -39080s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38955s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -38064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37802s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37674s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37549s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37424s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37299s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37174s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -37049s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36924s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36799s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36674s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36549s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36424s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36299s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -36174s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -35297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -35174s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -35049s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34924s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34799s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34674s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34548s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34424s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34299s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34174s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -34049s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33924s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33799s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33674s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33549s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33424s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -33299s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -32406s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -32298s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 1820 Thread sleep time: -32174s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33204139332677172s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -39830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -39689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -39340s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -39196s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -39066s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -38064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -37064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36568s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -36064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -35064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34689s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34564s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34439s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34314s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34189s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -34064s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33939s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33814s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33657s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33544s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33435s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 4680 Thread sleep time: -33324s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -10145709240540247s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39830s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6600 Thread sleep count: 1646 > 30 Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 6600 Thread sleep count: 431 > 30 Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39578s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39469s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39346s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39221s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -39096s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38920s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38721s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38451s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38345s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38221s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 5244 Thread sleep time: -38096s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39830s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39690s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1144 Thread sleep count: 1454 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1144 Thread sleep count: 227 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39565s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39449s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39323s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -39098s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38979s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38860s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38608s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38502s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38377s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe TID: 1020 Thread sleep time: -38252s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\random.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\random.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\random.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39705 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39580 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39455 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39330 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39205 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39080 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38955 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38829 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38705 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38580 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38455 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38330 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38165 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37911 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37798 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37673 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37549 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37423 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37298 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37173 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37048 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36923 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36798 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36673 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36548 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36423 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36298 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36173 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36048 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35923 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35799 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35673 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35548 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35376 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35252 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35080 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34935 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34705 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34580 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34455 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34330 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34205 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34080 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33955 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33705 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33580 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33455 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33330 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33205 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39705 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39580 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39455 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39330 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39205 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39080 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38955 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38564 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37802 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37674 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37549 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37424 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37299 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37174 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37049 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36924 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36799 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36674 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36549 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36424 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36299 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36174 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35297 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35174 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35049 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34924 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34799 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34674 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34548 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34424 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34299 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34174 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34049 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33924 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33799 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33674 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33549 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33424 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33299 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 32406 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 32298 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 32174 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39340 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39196 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39066 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38564 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37564 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 37064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36568 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 36064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35564 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 35064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34689 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34564 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34439 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34314 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34189 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 34064 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33939 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33814 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33657 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33544 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33435 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 33324 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39830 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39703 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39578 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39469 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39346 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39221 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 39096 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38920 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38721 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38451 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38345 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38221 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Thread delayed: delay time: 38096 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39830 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39690 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39565 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39449 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39323 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 39098 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38979 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38860 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38608 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38502 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38377 Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Thread delayed: delay time: 38252 Jump to behavior
Source: random.exe, 00000001.00000002.2010343903.0000000006934000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\random.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\random.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\random.exe Memory allocated: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\schtasks.exe "schtasks.exe" /Create /SC ONLOGON /TN "TaskHelper" /TR "C:\Users\user\Desktop\random.exe" /F Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Roaming\cEp3d38.exe "C:\Users\user\AppData\Roaming\cEp3d38.exe" Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\user\Desktop\random.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 4000 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Queries volume information: C:\Users\user\Desktop\random.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\cEp3d38.exe Queries volume information: C:\Users\user\AppData\Roaming\cEp3d38.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected LiteHTTP Bot
Source: Yara match File source: random.exe, type: SAMPLE
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 1.0.random.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2010343903.00000000069B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1340004308.0000000000CF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: random.exe PID: 1380, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\OneDrive\jdownloader.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows multimedia platform.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\autoit3.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windowspowershell.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\reference assemblies.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\common files.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows mail.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows defender.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows sidebar.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows photo viewer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\msecache.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\java.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\internet explorer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\mozilla maintenance service.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows nt.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\random.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft.net.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows media player.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\google.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft office.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows portable devices.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\msbuild.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\cEp3d38.exe, type: DROPPED

Remote Access Functionality
barindex
Yara detected LiteHTTP Bot
Source: Yara match File source: random.exe, type: SAMPLE
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: 1.0.random.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.2010343903.00000000069B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.1340004308.0000000000CF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: random.exe PID: 1380, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\OneDrive\jdownloader.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows multimedia platform.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\autoit3.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windowspowershell.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\reference assemblies.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\common files.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows mail.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows defender.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows sidebar.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows photo viewer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\msecache.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\java.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\internet explorer.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\mozilla maintenance service.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows nt.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\random.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft.net.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows media player.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\google.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\mmzjdoevgizobizuwenrntjysakvaaofwgwplryd.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\microsoft office.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\windows portable devices.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\OneDrive\msbuild.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Roaming\cEp3d38.exe, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1592066 Sample: random.exe Startdate: 15/01/2025 Architecture: WINDOWS Score: 100 40 tmpfiles.org 2->40 46 Suricata IDS alerts for network traffic 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for dropped file 2->50 52 7 other signatures 2->52 8 random.exe 16 234 2->8         started        13 random.exe 2->13         started        15 random.exe 2->15         started        17 random.exe 2->17         started        signatures3 process4 dnsIp5 42 87.120.126.5, 59239, 80 UNACS-AS-BG8000BurgasBG Bulgaria 8->42 44 tmpfiles.org 104.21.21.16, 443, 59240, 59241 CLOUDFLARENETUS United States 8->44 32 C:\Users\user\...\windowspowershell.exe, PE32 8->32 dropped 34 C:\Users\user\OneDrive\windows sidebar.exe, PE32 8->34 dropped 36 C:\Users\...\windows portable devices.exe, PE32 8->36 dropped 38 38 other malicious files 8->38 dropped 66 Protects its processes via BreakOnTermination flag 8->66 68 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 8->68 70 Self deletion via cmd or bat file 8->70 72 Uses schtasks.exe or at.exe to add and modify task schedules 8->72 19 cEp3d38.exe 8->19         started        22 cmd.exe 1 8->22         started        24 schtasks.exe 1 8->24         started        file6 signatures7 process8 signatures9 54 Antivirus detection for dropped file 19->54 56 Multi AV Scanner detection for dropped file 19->56 58 Machine Learning detection for dropped file 19->58 60 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 19->60 62 Uses ping.exe to sleep 22->62 64 Uses ping.exe to check the status of other devices and networks 22->64 26 conhost.exe 22->26         started        28 PING.EXE 1 22->28         started        30 conhost.exe 24->30         started        process10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.21.16
 tmpfiles.org United States
13335 CLOUDFLARENETUS false
87.120.126.5
 unknown Bulgaria
25206 UNACS-AS-BG8000BurgasBG true

Contacted Domains

Name IP Active
tmpfiles.org 104.21.21.16 true
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://tmpfiles.org/dl/19480319/anubis.exe false
  • Avira URL Cloud: safe
 unknown
http://87.120.126.5/VmCetSC7/page.php true
  • Avira URL Cloud: safe
 unknown
https://tmpfiles.org/dl/19480319/anubis.exe false
  • Avira URL Cloud: safe
 unknown