Windows Analysis Report
P87unxnF4t4DSrTt43.exe

Overview

General Information

Sample name: P87unxnF4t4DSrTt43.exe
Analysis ID: 1592534
MD5: 51bb5f38593e255c16ab2712757cda43
SHA1: 458fbe81fed707852864c3bcc4997b27d6a65832
SHA256: 1c80bf8e780ae58203e7f816c8fe04f66df434a3fbd981ba7c6e52e588622c03
Tags: exemalwareRemcosRATtrojanuser-Joker
Infos:

Detection

Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Remcos, RemcosRAT Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
 https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: P87unxnF4t4DSrTt43.exe Avira: detected
Antivirus detection for URL or domain
Source: www.kposlifestyle.design Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": ["www.kposlifestyle.design:2404:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-OH1QS4", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "edefdefffff", "Keylog file max size": ""}
Multi AV Scanner detection for submitted file
Source: P87unxnF4t4DSrTt43.exe Virustotal: Detection: 31% Perma Link
Source: P87unxnF4t4DSrTt43.exe ReversingLabs: Detection: 31%
Yara detected Remcos RAT
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\edefdefffff\logs.dat, type: DROPPED
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: P87unxnF4t4DSrTt43.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00432B45 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext, 6_2_00432B45
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_15f3a43b-4

Exploits
barindex
Yara detected UAC Bypass using CMSTP
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR

Privilege Escalation
barindex
Contains functionality to bypass UAC (CMSTPLUA)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406764 _wcslen,CoGetObject, 6_2_00406764
Uses 32bit PE files
Source: P87unxnF4t4DSrTt43.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: P87unxnF4t4DSrTt43.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: sPiG.pdbSHA256xsLF source: P87unxnF4t4DSrTt43.exe
Source: Binary string: sPiG.pdb source: P87unxnF4t4DSrTt43.exe
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 6_2_0040B335
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 6_2_0040B53A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose, 6_2_0041B63A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0044D7F9 FindFirstFileExA, 6_2_0044D7F9
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8, 6_2_004089A9
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406AC2 FindFirstFileW,FindNextFileW, 6_2_00406AC2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8, 6_2_00407A8C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose, 6_2_00408DA7
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW, 6_2_00418E5F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 6_2_00406F06

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.7:49704 -> 154.216.16.38:2404
Source: Network traffic Suricata IDS: 2032777 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Server Response : 154.216.16.38:2404 -> 192.168.2.7:49704
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.kposlifestyle.design
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49704 -> 154.216.16.38:2404
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.7:53968 -> 162.159.36.2:53
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 178.237.33.50 178.237.33.50
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49711 -> 178.237.33.50:80
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040455B WaitForSingleObject,SetEvent,recv, 6_2_0040455B
Source: global traffic HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: www.kposlifestyle.design
Source: global traffic DNS traffic detected: DNS query: geoplugin.net
Source: global traffic DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780695534.0000000001434000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, P87unxnF4t4DSrTt43.exe, 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://geoplugin.net/json.gp/C
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341026272.00000000032F8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to register a low level keyboard hook
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000 6_2_004099E4
Installs a global keyboard hook
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 6_2_00415B5E
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 6_2_00415B5E
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00415B5E OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 6_2_00415B5E
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00409B10 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx, 6_2_00409B10
Yara detected Keylogger Generic
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\edefdefffff\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands
barindex
Contains functionalty to change the wallpaper
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041BD82 SystemParametersInfoW, 6_2_0041BD82

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process Stats: CPU usage > 49%
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00415A51 ExitWindowsEx,LoadLibraryA,GetProcAddress, 6_2_00415A51
Detected potential crypto function
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_0184DC8C 1_2_0184DC8C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03062E68 1_2_03062E68
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03066310 1_2_03066310
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03066320 1_2_03066320
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_0306C708 1_2_0306C708
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03068450 1_2_03068450
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03067B0F 1_2_03067B0F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03067B20 1_2_03067B20
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03065AB0 1_2_03065AB0
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03062E59 1_2_03062E59
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03065ED8 1_2_03065ED8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_03065EE8 1_2_03065EE8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_05776F48 1_2_05776F48
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_057702D8 1_2_057702D8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_057702C8 1_2_057702C8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_05776F38 1_2_05776F38
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043D04B 6_2_0043D04B
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0042707E 6_2_0042707E
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041301D 6_2_0041301D
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00441030 6_2_00441030
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00453110 6_2_00453110
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004271B8 6_2_004271B8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041D27C 6_2_0041D27C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004522E2 6_2_004522E2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043D2A8 6_2_0043D2A8
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00437360 6_2_00437360
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004363BA 6_2_004363BA
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0042645F 6_2_0042645F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00431582 6_2_00431582
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043672C 6_2_0043672C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041E7EA 6_2_0041E7EA
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0044C949 6_2_0044C949
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004269D6 6_2_004269D6
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004369D6 6_2_004369D6
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043CBED 6_2_0043CBED
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00432C54 6_2_00432C54
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00436C9D 6_2_00436C9D
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043CE1C 6_2_0043CE1C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00436F58 6_2_00436F58
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00434F32 6_2_00434F32
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: String function: 00401F66 appears 50 times
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: String function: 004020E7 appears 40 times
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: String function: 00433AB0 appears 41 times
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: String function: 004341C0 appears 55 times
Sample file is different than original file name gathered from version info
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1338994663.000000000161E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1352629348.000000000B4C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000000.1321081732.0000000000E12000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamesPiG.exe4 vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMontero.dll8 vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1348548828.0000000005D20000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCaptive.dll" vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1349492914.0000000008CB8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXEj% vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe, 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCaptive.dll" vs P87unxnF4t4DSrTt43.exe
Source: P87unxnF4t4DSrTt43.exe Binary or memory string: OriginalFilenamesPiG.exe4 vs P87unxnF4t4DSrTt43.exe
Uses 32bit PE files
Source: P87unxnF4t4DSrTt43.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: P87unxnF4t4DSrTt43.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@7/8@3/2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00416C9D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError, 6_2_00416C9D
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040E2F1 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle, 6_2_0040E2F1
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041A84A FindResourceA,LoadResource,LockResource,SizeofResource, 6_2_0041A84A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 6_2_00419DBA
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P87unxnF4t4DSrTt43.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Mutant created: \Sessions\1\BaseNamedObjects\Rmc-OH1QS4
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wuc2hjpp.f05.ps1 Jump to behavior
Source: P87unxnF4t4DSrTt43.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: P87unxnF4t4DSrTt43.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: P87unxnF4t4DSrTt43.exe Virustotal: Detection: 31%
Source: P87unxnF4t4DSrTt43.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe" Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe" Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: P87unxnF4t4DSrTt43.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: P87unxnF4t4DSrTt43.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: P87unxnF4t4DSrTt43.exe Static file information: File size 1056768 > 1048576
Source: P87unxnF4t4DSrTt43.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x101600
Source: P87unxnF4t4DSrTt43.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: P87unxnF4t4DSrTt43.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: sPiG.pdbSHA256xsLF source: P87unxnF4t4DSrTt43.exe
Source: Binary string: sPiG.pdb source: P87unxnF4t4DSrTt43.exe
Binary contains a suspicious time stamp
Source: P87unxnF4t4DSrTt43.exe Static PE information: 0xA23B2A12 [Sat Apr 1 03:46:26 2056 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 6_2_0041BEEE
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 1_2_0184EEC2 push esp; iretd 1_2_0184EEC9
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004560BF push ecx; ret 6_2_004560D2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00434206 push ecx; ret 6_2_00434219
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0045E669 push ecx; ret 6_2_0045E67B
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0045C9DD push esi; ret 6_2_0045C9E6
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004569F0 push eax; ret 6_2_00456A0E
Source: P87unxnF4t4DSrTt43.exe Static PE information: section name: .text entropy: 7.766809579204765
Contains functionality to download and launch executables
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406128 ShellExecuteW,URLDownloadToFileW, 6_2_00406128
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00419DBA OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 6_2_00419DBA

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 6_2_0041BEEE
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Delayed program exit found
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040E627 Sleep,ExitProcess, 6_2_0040E627
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 1840000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 32B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 3060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 8E90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 7640000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: 9E90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: AE90000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: B580000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: C580000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: D580000 memory reserve | memory write watch Jump to behavior
Contains functionality to enumerate running services
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle, 6_2_00419AB8
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5908 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3717 Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Window / User API: threadDelayed 936 Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Window / User API: threadDelayed 8572 Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Window / User API: foregroundWindowGot 1769 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe TID: 7664 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8000 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe TID: 7908 Thread sleep time: -116000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe TID: 7912 Thread sleep time: -2808000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe TID: 7912 Thread sleep time: -25716000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose, 6_2_0040B335
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose, 6_2_0040B53A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041B63A FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose, 6_2_0041B63A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0044D7F9 FindFirstFileExA, 6_2_0044D7F9
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8, 6_2_004089A9
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406AC2 FindFirstFileW,FindNextFileW, 6_2_00406AC2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8, 6_2_00407A8C
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose, 6_2_00408DA7
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00418E5F FindFirstFileW,FindNextFileW,FindNextFileW, 6_2_00418E5F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW, 6_2_00406F06
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`)A
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780695534.000000000143B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_0043A86D
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041BEEE LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress, 6_2_0041BEEE
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00442764 mov eax, dword ptr fs:[00000030h] 6_2_00442764
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0044EB3E GetProcessHeap, 6_2_0044EB3E
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00434378 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 6_2_00434378
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0043A86D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_0043A86D
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00433D4F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 6_2_00433D4F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00433EE2 SetUnhandledExceptionFilter, 6_2_00433EE2
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe"
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Memory written: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe base: 400000 value starts with: 4D5A Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe 6_2_0041100E
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041894A mouse_event, 6_2_0041894A
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe" Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Process created: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe "C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe" Jump to behavior
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerS4\264
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerer
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager^F
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerSF
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManageruF
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: |Program Manager|
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerS4\f1
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.0000000001404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: bProgram ManagerZ^
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program ManagerS4\er
Source: P87unxnF4t4DSrTt43.exe, 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, logs.dat.6.dr Binary or memory string: [Program Manager]
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00434015 cpuid 6_2_00434015
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoA, 6_2_0040E751
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 6_2_0045107A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoW, 6_2_004512CA
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: EnumSystemLocalesW, 6_2_004472BE
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 6_2_004513F3
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoW, 6_2_004514FA
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 6_2_004515C7
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: GetLocaleInfoW, 6_2_004477A7
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW, 6_2_00450C8F
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: EnumSystemLocalesW, 6_2_00450F52
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: EnumSystemLocalesW, 6_2_00450F07
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: EnumSystemLocalesW, 6_2_00450FED
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Queries volume information: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_00404915 GetLocalTime,CreateEventA,CreateThread, 6_2_00404915
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0041A9AD GetComputerNameExW,GetUserNameW, 6_2_0041A9AD
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: 6_2_0044804A _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 6_2_0044804A
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\edefdefffff\logs.dat, type: DROPPED
Contains functionality to steal Chrome passwords or cookies
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data 6_2_0040B21B
Contains functionality to steal Firefox passwords or cookies
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\ 6_2_0040B335
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: \key3.db 6_2_0040B335

Remote Access Functionality
barindex
Detected Remcos RAT
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Mutex created: \Sessions\1\BaseNamedObjects\Rmc-OH1QS4 Jump to behavior
Yara detected Remcos RAT
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.P87unxnF4t4DSrTt43.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4fa76d8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4e2ea98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.P87unxnF4t4DSrTt43.exe.4eeb0b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.3780449094.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3779879332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1341710478.0000000004B23000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7644, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: P87unxnF4t4DSrTt43.exe PID: 7848, type: MEMORYSTR
Source: Yara match File source: C:\ProgramData\edefdefffff\logs.dat, type: DROPPED
Contains functionality to launch a control a shell (cmd.exe)
Source: C:\Users\user\Desktop\P87unxnF4t4DSrTt43.exe Code function: cmd.exe 6_2_00405042
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1592534 Sample: P87unxnF4t4DSrTt43.exe Startdate: 16/01/2025 Architecture: WINDOWS Score: 100 27 www.kposlifestyle.design 2->27 29 geoplugin.net 2->29 31 171.39.242.20.in-addr.arpa 2->31 37 Suricata IDS alerts for network traffic 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 11 other signatures 2->43 8 P87unxnF4t4DSrTt43.exe 4 2->8         started        signatures3 process4 file5 23 C:\Users\user\...\P87unxnF4t4DSrTt43.exe.log, ASCII 8->23 dropped 45 Contains functionality to bypass UAC (CMSTPLUA) 8->45 47 Contains functionalty to change the wallpaper 8->47 49 Contains functionality to steal Chrome passwords or cookies 8->49 51 5 other signatures 8->51 12 P87unxnF4t4DSrTt43.exe 4 15 8->12         started        17 powershell.exe 23 8->17         started        signatures6 process7 dnsIp8 33 www.kposlifestyle.design 154.216.16.38, 2404, 49704, 54065 SKHT-ASShenzhenKatherineHengTechnologyInformationCo Seychelles 12->33 35 geoplugin.net 178.237.33.50, 49711, 80 ATOM86-ASATOM86NL Netherlands 12->35 25 C:\ProgramData\edefdefffff\logs.dat, data 12->25 dropped 53 Detected Remcos RAT 12->53 55 Installs a global keyboard hook 12->55 57 Loading BitLocker PowerShell Module 17->57 19 WmiPrvSE.exe 17->19         started        21 conhost.exe 17->21         started        file9 signatures10 process11
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
178.237.33.50
 geoplugin.net Netherlands
8455 ATOM86-ASATOM86NL false
154.216.16.38
 www.kposlifestyle.design Seychelles
135357 SKHT-ASShenzhenKatherineHengTechnologyInformationCo true

Contacted Domains

Name IP Active
www.kposlifestyle.design 154.216.16.38 true
geoplugin.net 178.237.33.50 true
171.39.242.20.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://geoplugin.net/json.gp false
    		high
    www.kposlifestyle.design true
    • Avira URL Cloud: malware
    		 unknown