Windows Analysis Report
INV0062180.exe

Overview

General Information

Sample name: INV0062180.exe
Analysis ID: 1415798
MD5: 6aef5f1931bd1407f891b037b994414e
SHA1: a12e03d4a77c16cc9265edfc14ddc3e42ae1818e
SHA256: 3510d84f8b7c07db80eaf1f190ff3727c3ae95921cab2d308a711b1e14f62099
Tags: exe
Infos:

Detection

Snake Keylogger
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected Snake Keylogger
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
404 Keylogger, Snake Keylogger Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

AV Detection
barindex
Found malware configuration
Source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "jenny@surnvang.com", "Password": "zhBHMq@2", "Host": "smtp.surnvang.com", "Port": "587"}
Multi AV Scanner detection for domain / URL
Source: https://scratchdreams.tk Virustotal: Detection: 13% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Virustotal: Detection: 30% Perma Link
Multi AV Scanner detection for submitted file
Source: INV0062180.exe ReversingLabs: Detection: 18%
Source: INV0062180.exe Virustotal: Detection: 30% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: INV0062180.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: INV0062180.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: INV0062180.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: INV0062180.exe, 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, iqKlcCJyhhi.exe, 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://checkip.dyndns.org/q
Source: iqKlcCJyhhi.exe.0.dr String found in binary or memory: http://dev.neptuo.com
Source: INV0062180.exe, 00000000.00000002.2123632910.0000000002A22000.00000004.00000800.00020000.00000000.sdmp, iqKlcCJyhhi.exe, 0000000F.00000002.2166996658.0000000002552000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: INV0062180.exe, 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, iqKlcCJyhhi.exe, 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: INV0062180.exe, 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, iqKlcCJyhhi.exe, 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://scratchdreams.tk

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR Matched rule: Detects Snake Keylogger Author: ditekSHen
Detected potential crypto function
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_0103E06C 0_2_0103E06C
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF3EC0 0_2_06EF3EC0
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFD700 0_2_06EFD700
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF3417 0_2_06EF3417
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFB218 0_2_06EFB218
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFD1EB 0_2_06EFD1EB
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFD1F0 0_2_06EFD1F0
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF3EB2 0_2_06EF3EB2
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF2E28 0_2_06EF2E28
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF2E18 0_2_06EF2E18
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFADD9 0_2_06EFADD9
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFCDA8 0_2_06EFCDA8
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFCDB8 0_2_06EFCDB8
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF48E8 0_2_06EF48E8
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF48F8 0_2_06EF48F8
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF09C1 0_2_06EF09C1
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EF09D0 0_2_06EF09D0
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_08F439A8 0_2_08F439A8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0234E06C 15_2_0234E06C
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_023425D8 15_2_023425D8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_06853EC0 15_2_06853EC0
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685D700 15_2_0685D700
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_06853417 15_2_06853417
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685B218 15_2_0685B218
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685D1EA 15_2_0685D1EA
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685D1F0 15_2_0685D1F0
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_06853EB2 15_2_06853EB2
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_06852E18 15_2_06852E18
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_06852E28 15_2_06852E28
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685CDA8 15_2_0685CDA8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685CDB8 15_2_0685CDB8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685ADD9 15_2_0685ADD9
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685ADE0 15_2_0685ADE0
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_068548E8 15_2_068548E8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_068548F8 15_2_068548F8
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_068509D0 15_2_068509D0
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_08AF2C88 15_2_08AF2C88
Sample file is different than original file name gathered from version info
Source: INV0062180.exe, 00000000.00000002.2122739544.0000000000CBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs INV0062180.exe
Source: INV0062180.exe, 00000000.00000002.2129529492.00000000075B0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs INV0062180.exe
Source: INV0062180.exe, 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs INV0062180.exe
Source: INV0062180.exe, 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs INV0062180.exe
Source: INV0062180.exe Binary or memory string: OriginalFilenameAnQd.exeB vs INV0062180.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Uses 32bit PE files
Source: INV0062180.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: INV0062180.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: iqKlcCJyhhi.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, --m.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, --m.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, --.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, --m.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, --m.cs Cryptographic APIs: 'TransformFinalBlock'
Source: INV0062180.exe, ScheduledTaskManager.cs Task registration methods: 'CreateOrUpdateTask', 'CreateOrUpdateTaskUsingStartAt'
Source: INV0062180.exe, MainForm.cs Task registration methods: 'SaveChangesAndCreateTasks'
Source: iqKlcCJyhhi.exe.0.dr, ScheduledTaskManager.cs Task registration methods: 'CreateOrUpdateTask', 'CreateOrUpdateTaskUsingStartAt'
Source: iqKlcCJyhhi.exe.0.dr, MainForm.cs Task registration methods: 'SaveChangesAndCreateTasks'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, Xlpxv7SKIIhupSm8vT.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: _0020.SetAccessControl
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: _0020.AddAccessRule
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, Xlpxv7SKIIhupSm8vT.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: _0020.SetAccessControl
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, iksJTtWRndJrRiNTKN.cs Security API names: _0020.AddAccessRule
Source: 0.2.INV0062180.exe.29fc434.2.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.INV0062180.exe.2a0444c.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.INV0062180.exe.6ed0000.7.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.evad.winEXE@35/15@0/0
Source: C:\Users\user\Desktop\INV0062180.exe File created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Mutant created: \Sessions\1\BaseNamedObjects\EkyjihnCNCkVdCvnrxHFZzC
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6628:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5160:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6880:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Users\user\Desktop\INV0062180.exe File created: C:\Users\user\AppData\Local\Temp\tmp1E43.tmp Jump to behavior
Source: INV0062180.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: INV0062180.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
Source: C:\Users\user\Desktop\INV0062180.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: INV0062180.exe ReversingLabs: Detection: 18%
Source: INV0062180.exe Virustotal: Detection: 30%
Source: C:\Users\user\Desktop\INV0062180.exe File read: C:\Users\user\Desktop\INV0062180.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp1E43.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp2D85.tmp"
Source: C:\Windows\System32\conhost.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp1E43.tmp" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp2D85.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\INV0062180.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: INV0062180.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: INV0062180.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: INV0062180.exe, MainForm.cs .Net Code: InitializeComponent
Source: iqKlcCJyhhi.exe.0.dr, MainForm.cs .Net Code: InitializeComponent
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs .Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, iksJTtWRndJrRiNTKN.cs .Net Code: QeTGmISYZu System.Reflection.Assembly.Load(byte[])
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, iksJTtWRndJrRiNTKN.cs .Net Code: QeTGmISYZu System.Reflection.Assembly.Load(byte[])
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, wehuuoKhMKMbnQu72K.cs .Net Code: LOPk5OGwQvvejRfJl7n System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFE7A3 push esp; retf 0_2_06EFE7A9
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_06EFEBD0 push eax; iretd 0_2_06EFEBD5
Source: C:\Users\user\Desktop\INV0062180.exe Code function: 0_2_08F41DCE push ds; retf 0_2_08F41DCF
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_04BAB3E0 push eax; ret 15_2_04BAB413
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_04BAA8F1 push eax; mov dword ptr [esp], ecx 15_2_04BAA904
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_04BAA900 push eax; mov dword ptr [esp], ecx 15_2_04BAA904
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Code function: 15_2_0685E7A2 push esp; retf 15_2_0685E7A9
Source: INV0062180.exe Static PE information: section name: .text entropy: 7.860016994420722
Source: iqKlcCJyhhi.exe.0.dr Static PE information: section name: .text entropy: 7.860016994420722
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, kdFvaMFVPKs73pA7Ae.cs High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, DD.cs High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, ihWImL1h2qjtIkVYDh.cs High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, oImfMJtvGUo8fMQNBQ.cs High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.INV0062180.exe.6eb0000.6.raw.unpack, wehuuoKhMKMbnQu72K.cs High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, b2URMXH7d6wXagD8lk.cs High entropy of concatenated method names: 'ipSBAHjDci', 'g7jBOLtr8r', 'BGcBFx03jU', 'yvuBWafxHE', 'EusB7r9WNt', 'fy5BcQarlU', 'ly8BfS0jcF', 'sLjBJbKrAi', 'hcjBEWQ8mn', 'JmRBqGhRCm'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, LLQWvGzOa9M6402gO9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'm8V2B3ZRlC', 'JEJ2eiJ5ym', 'SgO24ktBAR', 'iP62hGlTqV', 'fIo2y4hmZj', 'g7g22Vb76v', 'Ka72C8bgTq'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, YcM1OmiAMsZHY1N2rL.cs High entropy of concatenated method names: 'x1K6n03RQE', 'sPD60eFHJN', 'bib6rDn4Yf', 'nuM6aifRYT', 'QUJ6YMNUOt', 'T9hro9G8UF', 'qdTr5rjP7R', 'BDGrT8eEPK', 'NBNrDi4mB2', 'kUMrKes6YZ'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, KGsyVKlnfjessdMfha.cs High entropy of concatenated method names: 'hdprt1Vccw', 'XZFrQXMfSS', 'x9cP8wmZDo', 'AxQP7D43MQ', 'EyKPcNw4UK', 'd6bPuHkeQr', 'gW1Pf8NAcV', 'p3uPJplQ5a', 'qRDPUCouQG', 'uYMPEFEjQx'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, GfSCTcaM4beVMfVvVE.cs High entropy of concatenated method names: 'zfkeEp0fol', 'vwaeMpEwoj', 'XXweSlYmJX', 'PA8exDJUko', 'UngeWMrxcV', 'KTte8VU5Tu', 'Qshe7OM1OP', 'ENrecSb0Ov', 'M8AeuDIuCP', 'K8Yefn9cMW'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, Xlpxv7SKIIhupSm8vT.cs High entropy of concatenated method names: 'Ifn0SvUb9w', 'WWR0xD6DSI', 'PxM01dORcD', 'yQa0lw7mL2', 'Hhy0okYuLo', 'kZx05rvIkQ', 'XtM0T52sGb', 'Bhf0DdNpsV', 'CAm0Ks0ys5', 'W8X0VBM4nZ'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, WXcS0UkUF4Ln84ubP1.cs High entropy of concatenated method names: 'LfehDun2d0', 'DNEhVrSRep', 'jJOyZych6F', 'K8Iy3uXuHx', 'ivmhqIKaly', 'r5BhMWN6yk', 'fZyhwm66hL', 'JuuhSMUrAu', 'JSZhxRVSYJ', 'Ih0h1WLr6i'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, Jj75kMsOXJM206xGaj.cs High entropy of concatenated method names: 'Dispose', 'GHN3K4VMg4', 'tRLIWyFuVY', 'aENRR1tjAs', 'u6Q3VOpBwZ', 'QDU3zeaiU8', 'ProcessDialogKey', 'q14IZP22Ab', 'vpVI3aRSTE', 'OTnII5wsZL'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, Qv80YWxeePkMTWbGMC.cs High entropy of concatenated method names: 'Lq0233Mcdy', 'UUH2gfxJWK', 'SlU2G7XWeQ', 'fyj29Eb2hS', 'Pv420y1C5U', 'UDJ2rA95KE', 'UOf26nVk9Q', 'JhoyTWBfPo', 'v1syD15wkv', 'PEsyK6p449'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, XGoZsef1qOI6fn4P3q.cs High entropy of concatenated method names: 'TOwajrAXLg', 'MVQabmBhLH', 'dRaamORnxj', 'g4IaduWlJ3', 'yqratSLPm6', 'gv5akbA0HS', 'vilaQi5qFS', 'J1haA2weGw', 'uB9aOujeyj', 'e3yain1rv1'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, JnRvWVUVUHFRPDMhtf.cs High entropy of concatenated method names: 'MxByFA2yEQ', 'zfdyWtKQqN', 'u08y8ZbcWP', 'omGy7cbBUB', 'Q7xyS9CGkL', 'UfcycILKal', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, fHVPK5eaZAyYUNB5py.cs High entropy of concatenated method names: 'Skfmg7cKl', 'TLddeT7Nj', 'qokkw7uTY', 'yiLQ1Pmbk', 'jkBOqUDMV', 'DhyiUcEpK', 'HDPdQ5FWJTNCxYhory', 'SHuPCyncXUIBYeWOxH', 'SbjygmtZw', 'vsuCdB1gS'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, I8qvdG4w8vQ48fQL69.cs High entropy of concatenated method names: 'jW33aKoFZT', 'o4C3YIkcJ3', 'rQZ3LUBeQh', 'Qht3NqwJ52', 'B3q3e1h5BN', 'bsn34fnIcp', 'piQ1kMHGXAxoZZZYR8', 'lC8aaXkJ91xd9iCTel', 'pQJ33wp0VO', 'MOu3g7q8vP'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, iksJTtWRndJrRiNTKN.cs High entropy of concatenated method names: 'H44gn784lF', 'egkg9Ha8bi', 'qQXg0HyNj2', 'sF7gPhO64K', 'z2MgrJmdH0', 'T7rg6wQwOG', 'y1AgaNgKkk', 'QZKgYgr05C', 'blBgpJSrhX', 'F8dgLKY9of'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, etypiHgDyU0WdGhoUx.cs High entropy of concatenated method names: 'KUNhLmocoi', 'hC7hNRcTLV', 'ToString', 'dYeh9EhkQX', 'Enih04mfuJ', 'ng6hPpLLRY', 'bRJhryraJ9', 'PSEh6a5COG', 'N8bhaIEfnp', 'gbehYk2seQ'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, PnJfdBDpF6tMmwkjDx.cs High entropy of concatenated method names: 'ToString', 'sq64q2lOrR', 'veq4W87jnX', 'HaL48NCWiK', 'M1S47oZXOr', 'RsR4cA2cdk', 'p9b4uZNSd2', 'APV4fqCwjV', 'uyC4J613le', 'Gvl4UTLWcV'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, orDyxlObkavATTLWBM.cs High entropy of concatenated method names: 'PRdy92YnqB', 'ekFy0s0dty', 'YXTyPjnJMQ', 'ulmyrr5kG6', 'FC5y6dIYVw', 'P6TyaOk7m8', 'l2CyYbEdSv', 'UkZypTdijk', 'AanyLgOW4K', 'XqByNfeMV6'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, jW0RenmmBSnn4UVy2g.cs High entropy of concatenated method names: 'XiDPd5sS1u', 'vU9PkA1Vfu', 'geqPAiBHZx', 'RS4POP5xF7', 'Y3JPe6SbV0', 'cH7P4EweKy', 'kg9PhnZFoA', 'dUvPyYuIoP', 'UZ7P2OYpUL', 'CsDPCfSTiS'
Source: 0.2.INV0062180.exe.3d393a0.5.raw.unpack, elDUQFyrSITPACXNlLO.cs High entropy of concatenated method names: 'WLJ2jCQSGL', 'GCS2bgSEyG', 'Jno2m1PJ9K', 'EoY2dv9JD4', 'X552t48y2r', 'oaQ2kV8eWu', 'T1e2QQeChe', 'WFD2AbsJEy', 'M3B2OX7TVk', 'HR12iy6aPk'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, b2URMXH7d6wXagD8lk.cs High entropy of concatenated method names: 'ipSBAHjDci', 'g7jBOLtr8r', 'BGcBFx03jU', 'yvuBWafxHE', 'EusB7r9WNt', 'fy5BcQarlU', 'ly8BfS0jcF', 'sLjBJbKrAi', 'hcjBEWQ8mn', 'JmRBqGhRCm'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, LLQWvGzOa9M6402gO9.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'm8V2B3ZRlC', 'JEJ2eiJ5ym', 'SgO24ktBAR', 'iP62hGlTqV', 'fIo2y4hmZj', 'g7g22Vb76v', 'Ka72C8bgTq'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, YcM1OmiAMsZHY1N2rL.cs High entropy of concatenated method names: 'x1K6n03RQE', 'sPD60eFHJN', 'bib6rDn4Yf', 'nuM6aifRYT', 'QUJ6YMNUOt', 'T9hro9G8UF', 'qdTr5rjP7R', 'BDGrT8eEPK', 'NBNrDi4mB2', 'kUMrKes6YZ'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, KGsyVKlnfjessdMfha.cs High entropy of concatenated method names: 'hdprt1Vccw', 'XZFrQXMfSS', 'x9cP8wmZDo', 'AxQP7D43MQ', 'EyKPcNw4UK', 'd6bPuHkeQr', 'gW1Pf8NAcV', 'p3uPJplQ5a', 'qRDPUCouQG', 'uYMPEFEjQx'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, GfSCTcaM4beVMfVvVE.cs High entropy of concatenated method names: 'zfkeEp0fol', 'vwaeMpEwoj', 'XXweSlYmJX', 'PA8exDJUko', 'UngeWMrxcV', 'KTte8VU5Tu', 'Qshe7OM1OP', 'ENrecSb0Ov', 'M8AeuDIuCP', 'K8Yefn9cMW'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, Xlpxv7SKIIhupSm8vT.cs High entropy of concatenated method names: 'Ifn0SvUb9w', 'WWR0xD6DSI', 'PxM01dORcD', 'yQa0lw7mL2', 'Hhy0okYuLo', 'kZx05rvIkQ', 'XtM0T52sGb', 'Bhf0DdNpsV', 'CAm0Ks0ys5', 'W8X0VBM4nZ'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, WXcS0UkUF4Ln84ubP1.cs High entropy of concatenated method names: 'LfehDun2d0', 'DNEhVrSRep', 'jJOyZych6F', 'K8Iy3uXuHx', 'ivmhqIKaly', 'r5BhMWN6yk', 'fZyhwm66hL', 'JuuhSMUrAu', 'JSZhxRVSYJ', 'Ih0h1WLr6i'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, Jj75kMsOXJM206xGaj.cs High entropy of concatenated method names: 'Dispose', 'GHN3K4VMg4', 'tRLIWyFuVY', 'aENRR1tjAs', 'u6Q3VOpBwZ', 'QDU3zeaiU8', 'ProcessDialogKey', 'q14IZP22Ab', 'vpVI3aRSTE', 'OTnII5wsZL'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, Qv80YWxeePkMTWbGMC.cs High entropy of concatenated method names: 'Lq0233Mcdy', 'UUH2gfxJWK', 'SlU2G7XWeQ', 'fyj29Eb2hS', 'Pv420y1C5U', 'UDJ2rA95KE', 'UOf26nVk9Q', 'JhoyTWBfPo', 'v1syD15wkv', 'PEsyK6p449'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, XGoZsef1qOI6fn4P3q.cs High entropy of concatenated method names: 'TOwajrAXLg', 'MVQabmBhLH', 'dRaamORnxj', 'g4IaduWlJ3', 'yqratSLPm6', 'gv5akbA0HS', 'vilaQi5qFS', 'J1haA2weGw', 'uB9aOujeyj', 'e3yain1rv1'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, JnRvWVUVUHFRPDMhtf.cs High entropy of concatenated method names: 'MxByFA2yEQ', 'zfdyWtKQqN', 'u08y8ZbcWP', 'omGy7cbBUB', 'Q7xyS9CGkL', 'UfcycILKal', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, fHVPK5eaZAyYUNB5py.cs High entropy of concatenated method names: 'Skfmg7cKl', 'TLddeT7Nj', 'qokkw7uTY', 'yiLQ1Pmbk', 'jkBOqUDMV', 'DhyiUcEpK', 'HDPdQ5FWJTNCxYhory', 'SHuPCyncXUIBYeWOxH', 'SbjygmtZw', 'vsuCdB1gS'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, I8qvdG4w8vQ48fQL69.cs High entropy of concatenated method names: 'jW33aKoFZT', 'o4C3YIkcJ3', 'rQZ3LUBeQh', 'Qht3NqwJ52', 'B3q3e1h5BN', 'bsn34fnIcp', 'piQ1kMHGXAxoZZZYR8', 'lC8aaXkJ91xd9iCTel', 'pQJ33wp0VO', 'MOu3g7q8vP'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, iksJTtWRndJrRiNTKN.cs High entropy of concatenated method names: 'H44gn784lF', 'egkg9Ha8bi', 'qQXg0HyNj2', 'sF7gPhO64K', 'z2MgrJmdH0', 'T7rg6wQwOG', 'y1AgaNgKkk', 'QZKgYgr05C', 'blBgpJSrhX', 'F8dgLKY9of'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, etypiHgDyU0WdGhoUx.cs High entropy of concatenated method names: 'KUNhLmocoi', 'hC7hNRcTLV', 'ToString', 'dYeh9EhkQX', 'Enih04mfuJ', 'ng6hPpLLRY', 'bRJhryraJ9', 'PSEh6a5COG', 'N8bhaIEfnp', 'gbehYk2seQ'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, PnJfdBDpF6tMmwkjDx.cs High entropy of concatenated method names: 'ToString', 'sq64q2lOrR', 'veq4W87jnX', 'HaL48NCWiK', 'M1S47oZXOr', 'RsR4cA2cdk', 'p9b4uZNSd2', 'APV4fqCwjV', 'uyC4J613le', 'Gvl4UTLWcV'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, orDyxlObkavATTLWBM.cs High entropy of concatenated method names: 'PRdy92YnqB', 'ekFy0s0dty', 'YXTyPjnJMQ', 'ulmyrr5kG6', 'FC5y6dIYVw', 'P6TyaOk7m8', 'l2CyYbEdSv', 'UkZypTdijk', 'AanyLgOW4K', 'XqByNfeMV6'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, jW0RenmmBSnn4UVy2g.cs High entropy of concatenated method names: 'XiDPd5sS1u', 'vU9PkA1Vfu', 'geqPAiBHZx', 'RS4POP5xF7', 'Y3JPe6SbV0', 'cH7P4EweKy', 'kg9PhnZFoA', 'dUvPyYuIoP', 'UZ7P2OYpUL', 'CsDPCfSTiS'
Source: 0.2.INV0062180.exe.75b0000.8.raw.unpack, elDUQFyrSITPACXNlLO.cs High entropy of concatenated method names: 'WLJ2jCQSGL', 'GCS2bgSEyG', 'Jno2m1PJ9K', 'EoY2dv9JD4', 'X552t48y2r', 'oaQ2kV8eWu', 'T1e2QQeChe', 'WFD2AbsJEy', 'M3B2OX7TVk', 'HR12iy6aPk'
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, kdFvaMFVPKs73pA7Ae.cs High entropy of concatenated method names: 'jlLbsIppcp4pe', 'HUDVafGQx3A5lYPXEbC', 'bWxlDPGFKtjOUjq8ME9', 'J13JY7Gs9VegMR0Usdn', 'gjnvHYGCPTFBSN5sXDA', 'UXn9pRGVr5JYGFjuCRJ', 'g8bQ3yGYPoLwrRusK3E', 'KwwAwLG5jtFVjgr5V0l', 'lJyLiGG0wAjthymuVo5', 'KrHGd2G9wj507LdZGDe'
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, DD.cs High entropy of concatenated method names: 'wgRxinKHcbWANUbFNm', 'dwveif1E9jqp4XTbTA', 'iYTXHL2SDoNZBJVsGw', 'hFySdn3keDBvJSvKal', 'PVIytPpWpuEYQLk40u'
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, ihWImL1h2qjtIkVYDh.cs High entropy of concatenated method names: 'qJUttacKFT', 'djwp7oGHZ8xfNf3m5ut', 'AZqALCG67UykKuowXP2', 'dkLCJpGlCfFdqtD7Epf', 'iHWSkAGjDuGN31hXJsT', 'u4UYnDGE5xCOMnt15QR', 'jhES7Va4c', 'jWmROKkjL', 'Dispose', 'BJj7gBhfp'
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, oImfMJtvGUo8fMQNBQ.cs High entropy of concatenated method names: 'cxsORewNJ', 'VvrninWuk', 'ustvIxt9o', 'QtXoY7g0N', 'cMKlMbnQu', 'w2KLAB5Xx', 'hNkF6TG2YCh7xU8s3hJ', 'hs4l1PGKtLhAeRnm1c4', 'Dispose', 'MoveNext'
Source: 0.2.INV0062180.exe.29e8424.0.raw.unpack, wehuuoKhMKMbnQu72K.cs High entropy of concatenated method names: 'NXMyxc8eI', 'GTZadPHeP', 'DEVNaDCj9', 'cflmBNqev', 'VFQ0OImLC', 'PbYVMxZvt', 'UPdFjbLed', 'AeEi93ui9', 'oM66buTLn', 'nxFUIfcfn'
Drops PE files
Source: C:\Users\user\Desktop\INV0062180.exe File created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp1E43.tmp"
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: 29C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: 2910000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: 7620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: 8620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: 7620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 2340000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 24F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 44F0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 6DA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 7DA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Memory allocated: 6DA0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\INV0062180.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5755 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1027 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6307 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 650 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\INV0062180.exe TID: 3800 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4832 Thread sleep count: 5755 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3472 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7008 Thread sleep count: 1027 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1592 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3744 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 424 Thread sleep time: -1844674407370954s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe TID: 4948 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\INV0062180.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: iqKlcCJyhhi.exe, 0000000F.00000002.2166365857.00000000008D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: C:\Users\user\Desktop\INV0062180.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\INV0062180.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\INV0062180.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe"
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp1E43.tmp" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Process created: C:\Users\user\Desktop\INV0062180.exe "C:\Users\user\Desktop\INV0062180.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iqKlcCJyhhi" /XML "C:\Users\user\AppData\Local\Temp\tmp2D85.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Process created: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe "C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Users\user\Desktop\INV0062180.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Queries volume information: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\iqKlcCJyhhi.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\INV0062180.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR
Yara detected Credential Stealer
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Snake Keylogger
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.381b990.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.iqKlcCJyhhi.exe.37fb170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ceb7a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.INV0062180.exe.3ccaf88.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000F.00000002.2167752600.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2124375456.0000000003CCA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: INV0062180.exe PID: 1512, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: iqKlcCJyhhi.exe PID: 2912, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1415798 Sample: INV0062180.exe Startdate: 26/03/2024 Architecture: WINDOWS Score: 100 43 Multi AV Scanner detection for domain / URL 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 7 other signatures 2->49 7 INV0062180.exe 7 2->7         started        11 iqKlcCJyhhi.exe 5 2->11         started        process3 file4 39 C:\Users\user\AppData\...\iqKlcCJyhhi.exe, PE32 7->39 dropped 41 C:\Users\user\AppData\Local\...\tmp1E43.tmp, XML 7->41 dropped 51 Uses schtasks.exe or at.exe to add and modify task schedules 7->51 53 Adds a directory exclusion to Windows Defender 7->53 13 powershell.exe 22 7->13         started        15 powershell.exe 23 7->15         started        17 schtasks.exe 1 7->17         started        25 5 other processes 7->25 55 Multi AV Scanner detection for dropped file 11->55 57 Machine Learning detection for dropped file 11->57 19 schtasks.exe 1 11->19         started        21 iqKlcCJyhhi.exe 11->21         started        23 iqKlcCJyhhi.exe 11->23         started        27 3 other processes 11->27 signatures5 process6 process7 29 WmiPrvSE.exe 13->29         started        31 conhost.exe 13->31         started        33 conhost.exe 15->33         started        35 conhost.exe 17->35         started        37 conhost.exe 19->37         started       
⊘No contacted IP infos