Edit tour

Windows Analysis Report
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Overview

General Information

Sample name:	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
Analysis ID:	1430138
MD5:	f2c8f168ab79a0fadb6234b193c52255
SHA1:	ea8f5594f5c3d0e0e317828d8a0316c20b21f1d8
SHA256:	02f1e7955a182f8488b636ec84999bf14b186905e84e3dc796a8eeb1dc84177f
Tags:	base64-decodedexe
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe (PID: 7100 cmdline: "C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe" MD5: F2C8F168AB79A0FADB6234B193C52255)

WerFault.exe (PID: 3620 cmdline: C:\Windows\system32\WerFault.exe -u -p 7100 -s 1572 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["aprilxrwonew8450.duckdns.org"], "Port": "8450", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x70c4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7161:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7276:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d70:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6ec4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6f61:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7076:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6b70:$cnc4: POST / HTTP/1.1
00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe PID: 7100	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x70c4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7161:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7276:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d70:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes - Source IP: 134.255.217.251 - Destination IP: 192.168.2.5

Timestamp:	04/23/24-08:13:20.288518
SID:	2852870
Source Port:	8450
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.5 - Destination IP: 134.255.217.251

Timestamp:	04/23/24-08:13:07.503950
SID:	2855924
Source Port:	49712
Destination Port:	8450
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 - Source IP: 134.255.217.251 - Destination IP: 192.168.2.5

Timestamp:	04/23/24-08:13:20.288518
SID:	2852874
Source Port:	8450
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["aprilxrwonew8450.duckdns.org"], "Port": "8450", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V3.1"}

Multi AV Scanner detection for submitted file

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	ReversingLabs: Detection: 78%
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Virustotal: Detection: 67%			Perma Link

Machine Learning detection for sample

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	String decryptor: aprilxrwonew8450.duckdns.org
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	String decryptor: 8450
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	String decryptor: <123456789>
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	String decryptor: USB.exe

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.pdbMZ source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbh-J source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2959782381.0000000000983000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B430000.00000004.00000020.00020000.00000000.sdmp, 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp, WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbl source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbSystem.Core.dll source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdbP source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbB source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.PDB source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855924 ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound 192.168.2.5:49712 -> 134.255.217.251:8450
Source: Traffic	Snort IDS: 2852874 ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2 134.255.217.251:8450 -> 192.168.2.5:49712
Source: Traffic	Snort IDS: 2852870 ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes 134.255.217.251:8450 -> 192.168.2.5:49712

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: aprilxrwonew8450.duckdns.org

Uses dynamic DNS services

Source: unknown

DNS query: name: aprilxrwonew8450.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49712 -> 134.255.217.251:8450

Source: Joe Sandbox View

ASN Name: ACTIVE-SERVERSactive-serverscomDE ACTIVE-SERVERSactive-serverscomDE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: aprilxrwonew8450.duckdns.org

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Code function: 0_2_00007FF848F29A7D	0_2_00007FF848F29A7D
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Code function: 0_2_00007FF848F27292	0_2_00007FF848F27292
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Code function: 0_2_00007FF848F264E6	0_2_00007FF848F264E6

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7100 -s 1572

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameaprilxrwonew8450.exe4 vs 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Binary or memory string: OriginalFilenameaprilxrwonew8450.exe4 vs 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/5@22/1

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7100
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\0VZWHbNr1OapRPc5

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\4f770d6f-30a5-4dc4-9900-70ec29208c63

Jump to behavior

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	ReversingLabs: Detection: 78%
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

File read: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe "C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe"
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7100 -s 1572

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Xml.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.pdbMZ source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Configuration.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: symbols\dll\mscorlib.pdbpdb` source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Xml.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.pdbh-J source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2959782381.0000000000983000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B430000.00000004.00000020.00020000.00000000.sdmp, 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp, WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdbl source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdbSystem.Core.dll source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Drawing.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: Microsoft.VisualBasic.pdbP source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: mscorlib.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Management.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbB source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.PDB source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: indoC:\Windows\mscorlib.pdb source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962111283.000000001B319000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER96BA.tmp.dmp.6.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER96BA.tmp.dmp.6.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Code function: 0_2_00007FF848F224ED push ebx; iretd		0_2_00007FF848F2250A
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Code function: 0_2_00007FF848F224F8 push ebx; iretd		0_2_00007FF848F2250A

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Memory allocated: C00000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Memory allocated: 1A8B0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Window / User API: threadDelayed 8726			Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Window / User API: threadDelayed 1058			Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe TID: 7128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe TID: 5808	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe TID: 6052	Thread sleep count: 8726 > 30	Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe TID: 6052	Thread sleep count: 1058 > 30	Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B430000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Queries volume information: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B469000.00000004.00000020.00020000.00000000.sdmp, 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2962178051.000000001B422000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe PID: 7100, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe PID: 7100, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	1 Input Capture	31 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	21 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	68%	Virustotal		Browse
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	100%	Avira	TR/Spy.Gen
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
aprilxrwonew8450.duckdns.org	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
aprilxrwonew8450.duckdns.org	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
aprilxrwonew8450.duckdns.org	134.255.217.251	true	true	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
aprilxrwonew8450.duckdns.org	true	3%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.6.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe, 00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
134.255.217.251	aprilxrwonew8450.duckdns.org	Germany		197071	ACTIVE-SERVERSactive-serverscomDE	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430138
Start date and time:	2024-04-23 08:11:21 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/5@22/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:12:08	API Interceptor	1768803x Sleep call for process: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe modified
08:13:44	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
134.255.217.251	72625413524.vbs	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
aprilxrwonew8450.duckdns.org	72625413524.vbs	Get hash	malicious	XWorm	Browse	134.255.217.251

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ACTIVE-SERVERSactive-serverscomDE	72625413524.vbs	Get hash	malicious	XWorm	Browse	134.255.217.251
	ft1i6jvAdD.exe	Get hash	malicious	Xmrig	Browse	134.255.231.136
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	95.156.228.183
	1B8943B2CCEA3EE9E464B5865711DB721BAE33CA03646.exe	Get hash	malicious	BazaLoader, SmokeLoader	Browse	134.255.232.95
	Summaryform_XsssmAVjTv.wsf	Get hash	malicious	AsyncRAT, zgRAT	Browse	134.255.225.46
	http://vps-zap756882-1.zap-srv.com	Get hash	malicious	Unknown	Browse	134.255.234.208
	3fB3EuUEe7.exe	Get hash	malicious	Quasar	Browse	134.255.254.225
	dl2.exe	Get hash	malicious	Unknown	Browse	31.214.240.203
	mpsl.elf	Get hash	malicious	Mirai	Browse	95.156.228.199
	KY40Vey3Ml.elf	Get hash	malicious	Mirai	Browse	95.156.228.196

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_32X35O1GVFF441YB_b619331d6ebfaa752cb39228ca38361cc95838_cdc271f5_2bffae22-1b23-4138-931c-592607ee6959\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3178252901695047
Encrypted:	false
SSDEEP:	384:Sj0Rovm2DCI81i5Jxa48iYdnzuiF9Y4lO8IOB:8TCI81ihaBtzuiF9Y4lO8
MD5:	E19F3D7C33B789A9104E549CACF12420
SHA1:	3D2DA9436E3EF2601F79335CCAB1A21BB876E9C0
SHA-256:	1E333933AC49E070B802509FE9854AF77E6A367C50579EB09EDCED09D9D2194E
SHA-512:	46050C12B399346BA0A3D9F63559C4DED78E7B7BE529684347FF8D37F374D49DCA7923D2012332E3C02228D09469E2FBC16EFD69ECEB1B9FDDC36E2E1CB7684F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.3.2.6.4.1.5.3.8.4.8.0.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.3.2.6.4.1.6.1.3.4.8.0.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.f.f.a.e.2.2.-.1.b.2.3.-.4.1.3.8.-.9.3.1.c.-.5.9.2.6.0.7.e.e.6.9.5.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.c.6.c.5.4.1.-.8.1.f.5.-.4.c.1.4.-.8.a.f.8.-.8.f.2.5.9.8.9.a.b.2.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.1.7.1.3.8.5.2.0.6.7.4.5.9.5.6.2.9.f.0.3.6.0.9.2.0.8.3.c.d.6.f.6.7.b.d.b.e.7.3.6.9.6.3.8.0.7.6.e.0.b.4.4.3.5.b.e.5.5.a.c.1.0.7.6.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.a.p.r.i.l.x.r.w.o.n.e.w.8.4.5.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.b.c.-.0.0.0.1.-.0.0.1.4.-.f.4.6.f.-.a.0.2.b.4.5.9.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.0.c.6.f.6.e.e.3.3.b.e.2.1.4.5.3.6.e.7.d.e.f.7.c.3.e.0.c.d.c.9.0.0.0.0.0.0.0.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96BA.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Tue Apr 23 06:13:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	517874
Entropy (8bit):	3.164945325571048
Encrypted:	false
SSDEEP:	3072:An7TaH72HgY3Pf4xX6S6VcSm4UF71CCq4FjMe3+vNQgRhz59UDE:i7TaH72Hj3uX6S61m4UNqo53QNQqX9
MD5:	31D46D75196EB385E61EA6468FAF08A7
SHA1:	BF839ADCFAD8EA61FEC43BD83588B7732C0726A3
SHA-256:	B82C2E16B990EF6483DE7B8305BFB0B16F0B91DBA3992C4DDB1C89380F63A40E
SHA-512:	1EFB2F309083640AAA1B209E88DDE986CAACAF0E84E7A8D06260C5450EAF6EED1248E6E205EBFFC1A66BCBB76E8F0187C6F5870D4543F24660C9EC6A7B28114F
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........Q'f........................d...$.......$....(...........(.......=..............l.......8...........T............=..*...........p6..........\8..............................................................................eJ.......8......Lw......................T...........7Q'f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER989F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	3.7123802078139647
Encrypted:	false
SSDEEP:	192:R6l7wVeJv7Cges6YEI4giIgmfZRxd8Xpr289bBqz6FfzjLm:R6lXJzlV6YEnglgmfPbcBu6Ffi
MD5:	1C4F0B9A724F5BD54E98D3592C3CC816
SHA1:	348A350FD404834B4410332E257CF38DCC44E61F
SHA-256:	84049CA490090483E3F4CB9EE1BCA38CE98440FDA494C3D57A64A689B5BE688B
SHA-512:	03BF4A71F2E737BBF86C285831239D3D798EA3AB0727FE3E5CC77086B9ABB84B7EFAAB44F2811B36BB0AB21BC0522F1E26D3918852847F995BC15DF59B8EE221
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.0.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER98DF.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5051
Entropy (8bit):	4.5833514820012775
Encrypted:	false
SSDEEP:	48:cvIwWl8zs5Jg771I9j4WpW8VY3Ym8M4JZg3oFXQ9yq8vt0X7UJy5yOrd:uIjfLI78x7VLJyWqX7UAQOrd
MD5:	752678548C59D6CDD503EC0AB2A72A46
SHA1:	972AC5631949B5011901C55BF1286F32B158B50E
SHA-256:	D303ACCF905ADA421E8D723216DF9449353C444B562ABB45BA024C6FE56F5431
SHA-512:	3B89A379C6A163B11E7C06021E6246086E7298624D917DF1FEF283DECC4DCDDF364782C088C3AFED5AF30AA4D1C41B5D3F0992261EDBBFE1E3088BFB0DF67B22
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="292156" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.422180960938102
Encrypted:	false
SSDEEP:	6144:iSvfpi6ceLP/9skLmb0OTQWSPHaJG8nAgeMZMMhA2fX4WABlEnNG0uhiTw:xvloTQW+EZMM6DFys03w
MD5:	DF9748F944C827DD2CEA7DCC85C87AA9
SHA1:	5C60984A60FFC493B51D9C90918B63497B3ADB01
SHA-256:	1A8457334E26273756579248BF04DCBBE5B941497021AF867F75F2C1B7581AC9
SHA-512:	8919F7A5E68D42D8A7AB2FB8E319C5C2BAE9364BF11FFA5AC27AE41FB763BFF3C9F1FBE9C7F0487924D271D6FD4289228AC82364EDC04E6E14691CE9F98912FD
Malicious:	false
Reputation:	low
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..._E...............................................................................................................................................................................................................................................................................................................................................a..k........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.5558514274806665
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
File size:	34'816 bytes
MD5:	f2c8f168ab79a0fadb6234b193c52255
SHA1:	ea8f5594f5c3d0e0e317828d8a0316c20b21f1d8
SHA256:	02f1e7955a182f8488b636ec84999bf14b186905e84e3dc796a8eeb1dc84177f
SHA512:	5ec1c4d1f22fd304166d94fd227c16630e1574ae0281dab8dd92ed74f82b91a345999131a464bcb7b51fb1b0d5dfeb94180b7a4abc3dc2a593802f732ae62575
SSDEEP:	768:o4fK1pDGkptwyZScCBSUapNgqlrU/kZB+Bcg4tlTF592unO9hJSURG:4DGkptwyZScCkU4rFUsZIB54HF592qO+
TLSH:	C6F22A487FE4822ACAFE2BF529F2661503B4D503EA13D75E18D8459A6F37BC08D013E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a&f.................~............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x409bfe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x662661E7 [Mon Apr 22 13:11:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9bb0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x500	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7c04	0x7e00	e0ca28046e78a561b11f7ac7d51ebbea	False	0.49618675595238093	data	5.6961191411544485	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x500	0x600	8950cfec307854250d6eb59d021ac9ad	False	0.3815104166666667	data	3.789894194592707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	064217dac52cd36d16d6abd04b448fd6	False	0.041015625	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0a0	0x26c	data			0.4596774193548387
RT_MANIFEST	0xa310	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-08:13:20.288518	TCP	2852870	ETPRO TROJAN Win32/XWorm CnC Checkin - Generic Prefix Bytes	8450	49712	134.255.217.251	192.168.2.5
04/23/24-08:13:07.503950	TCP	2855924	ETPRO TROJAN Win32/XWorm V3 CnC Command - PING Outbound	49712	8450	192.168.2.5	134.255.217.251
04/23/24-08:13:20.288518	TCP	2852874	ETPRO TROJAN Win32/XWorm CnC PING Command Inbound M2	8450	49712	134.255.217.251	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 08:12:52.741617918 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:12:52.909832954 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:12:52.909972906 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:12:53.077332973 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:12:53.288268089 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:07.503950119 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:13:07.727294922 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:20.288517952 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:20.338387966 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:13:21.854366064 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:13:22.069516897 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:27.104613066 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:13:27.335145950 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:32.261490107 CEST	49712	8450	192.168.2.5	134.255.217.251
Apr 23, 2024 08:13:32.475910902 CEST	8450	49712	134.255.217.251	192.168.2.5
Apr 23, 2024 08:13:45.081897974 CEST	49712	8450	192.168.2.5	134.255.217.251

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 08:12:09.893205881 CEST	51273	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:10.885654926 CEST	51273	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:11.885720968 CEST	51273	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:13.901439905 CEST	51273	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:13.984239101 CEST	53	51273	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:13.984258890 CEST	53	51273	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:13.984272003 CEST	53	51273	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:13.989425898 CEST	53	51273	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:14.106355906 CEST	53123	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:14.195065975 CEST	53	53123	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:21.824253082 CEST	50437	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:22.823151112 CEST	50437	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:24.907093048 CEST	50437	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:25.915754080 CEST	53	50437	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:25.915776968 CEST	53	50437	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:25.915790081 CEST	53	50437	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:28.997531891 CEST	51631	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:29.997648001 CEST	51631	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:31.010735989 CEST	51631	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:33.010482073 CEST	51631	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:33.089382887 CEST	53	51631	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:33.089428902 CEST	53	51631	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:33.089483023 CEST	53	51631	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:33.098712921 CEST	53	51631	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:37.136614084 CEST	61356	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:38.136619091 CEST	61356	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:39.135896921 CEST	61356	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:41.151401997 CEST	61356	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:41.229538918 CEST	53	61356	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:41.229597092 CEST	53	61356	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:41.229613066 CEST	53	61356	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:41.239721060 CEST	53	61356	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:42.538690090 CEST	55523	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:43.526109934 CEST	55523	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:44.541723967 CEST	55523	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:46.557382107 CEST	55523	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:46.629349947 CEST	53	55523	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:46.629401922 CEST	53	55523	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:46.629417896 CEST	53	55523	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:46.645359039 CEST	53	55523	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:51.120903969 CEST	63923	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:52.135564089 CEST	63923	53	192.168.2.5	1.1.1.1
Apr 23, 2024 08:12:52.735671997 CEST	53	63923	1.1.1.1	192.168.2.5
Apr 23, 2024 08:12:52.735722065 CEST	53	63923	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 08:12:09.893205881 CEST	192.168.2.5	1.1.1.1	0x62a8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:10.885654926 CEST	192.168.2.5	1.1.1.1	0x62a8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:11.885720968 CEST	192.168.2.5	1.1.1.1	0x62a8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:13.901439905 CEST	192.168.2.5	1.1.1.1	0x62a8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:14.106355906 CEST	192.168.2.5	1.1.1.1	0xa084	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:21.824253082 CEST	192.168.2.5	1.1.1.1	0x35d8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:22.823151112 CEST	192.168.2.5	1.1.1.1	0x35d8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:24.907093048 CEST	192.168.2.5	1.1.1.1	0x35d8	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:28.997531891 CEST	192.168.2.5	1.1.1.1	0x4aaf	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:29.997648001 CEST	192.168.2.5	1.1.1.1	0x4aaf	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:31.010735989 CEST	192.168.2.5	1.1.1.1	0x4aaf	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:33.010482073 CEST	192.168.2.5	1.1.1.1	0x4aaf	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:37.136614084 CEST	192.168.2.5	1.1.1.1	0x963	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:38.136619091 CEST	192.168.2.5	1.1.1.1	0x963	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:39.135896921 CEST	192.168.2.5	1.1.1.1	0x963	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:41.151401997 CEST	192.168.2.5	1.1.1.1	0x963	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:42.538690090 CEST	192.168.2.5	1.1.1.1	0xfe37	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:43.526109934 CEST	192.168.2.5	1.1.1.1	0xfe37	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:44.541723967 CEST	192.168.2.5	1.1.1.1	0xfe37	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:46.557382107 CEST	192.168.2.5	1.1.1.1	0xfe37	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:51.120903969 CEST	192.168.2.5	1.1.1.1	0xc62b	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:52.135564089 CEST	192.168.2.5	1.1.1.1	0xc62b	Standard query (0)	aprilxrwonew8450.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 08:12:13.984239101 CEST	1.1.1.1	192.168.2.5	0x62a8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:13.984258890 CEST	1.1.1.1	192.168.2.5	0x62a8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:13.984272003 CEST	1.1.1.1	192.168.2.5	0x62a8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:13.989425898 CEST	1.1.1.1	192.168.2.5	0x62a8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:14.195065975 CEST	1.1.1.1	192.168.2.5	0xa084	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:25.915754080 CEST	1.1.1.1	192.168.2.5	0x35d8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:25.915776968 CEST	1.1.1.1	192.168.2.5	0x35d8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:25.915790081 CEST	1.1.1.1	192.168.2.5	0x35d8	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:33.089382887 CEST	1.1.1.1	192.168.2.5	0x4aaf	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:33.089428902 CEST	1.1.1.1	192.168.2.5	0x4aaf	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:33.089483023 CEST	1.1.1.1	192.168.2.5	0x4aaf	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:33.098712921 CEST	1.1.1.1	192.168.2.5	0x4aaf	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:41.229538918 CEST	1.1.1.1	192.168.2.5	0x963	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:41.229597092 CEST	1.1.1.1	192.168.2.5	0x963	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:41.229613066 CEST	1.1.1.1	192.168.2.5	0x963	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:41.239721060 CEST	1.1.1.1	192.168.2.5	0x963	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:46.629349947 CEST	1.1.1.1	192.168.2.5	0xfe37	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:46.629401922 CEST	1.1.1.1	192.168.2.5	0xfe37	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:46.629417896 CEST	1.1.1.1	192.168.2.5	0xfe37	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:46.645359039 CEST	1.1.1.1	192.168.2.5	0xfe37	Server failure (2)	aprilxrwonew8450.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:52.735671997 CEST	1.1.1.1	192.168.2.5	0xc62b	No error (0)	aprilxrwonew8450.duckdns.org		134.255.217.251	A (IP address)	IN (0x0001)	false
Apr 23, 2024 08:12:52.735722065 CEST	1.1.1.1	192.168.2.5	0xc62b	No error (0)	aprilxrwonew8450.duckdns.org		134.255.217.251	A (IP address)	IN (0x0001)	false

Analysis Process: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exePID: 7100, Parent PID: 1028

General

Target ID:	0
Start time:	08:12:07
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe"
Imagebase:	0x3c0000
File size:	34'816 bytes
MD5 hash:	F2C8F168AB79A0FADB6234B193C52255
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1995534590.00000000003C2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.2960481827.00000000028B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:13:35
Start date:	23/04/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7100 -s 1572
Imagebase:	0x7ff6bd890000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exePID: 7100, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	18.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848F29A7D Relevance: .8, Instructions: 840
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2962948177.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f4c86f3157ab7f4e9b287db99a6a218395a343a582d1e62e311f9f43bc8338
Instruction ID: 1190ae24d241f1ca434a83fba0dca2953e8d7469f7fd82d2486680d3b5346b1a
Opcode Fuzzy Hash: 65f4c86f3157ab7f4e9b287db99a6a218395a343a582d1e62e311f9f43bc8338
Instruction Fuzzy Hash: 74424E31B1C9098FEB94FB389456A7973E2EF99390F504979D41EC32C6DF29E8828744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F264E6 Relevance: .5, Instructions: 472
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2962948177.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0e268cd00ff7ba22120903b5330a7632e92813a7ae7611d8db00cddf9a1e5a
Instruction ID: 6209fc4394b5a449d641f8bcca96bd8243b7886f93ebbb3bb725080bf6670ad6
Opcode Fuzzy Hash: cc0e268cd00ff7ba22120903b5330a7632e92813a7ae7611d8db00cddf9a1e5a
Instruction Fuzzy Hash: A1F1813090CA8D8FEBA8EF28D8557E937E1FF54350F04426EE84DC7291DB3998458B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F27292 Relevance: .5, Instructions: 458
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2962948177.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2524d73a87ab4e913d8382027ac55ad0fcce808d10341accd6150a45a28f7a
Instruction ID: 831b6ab5104c75c3dcdc8cf989675a3878268268c17584f92164080de6d87b9e
Opcode Fuzzy Hash: 4c2524d73a87ab4e913d8382027ac55ad0fcce808d10341accd6150a45a28f7a
Instruction Fuzzy Hash: 59E1A23090CA4D8FEBA8EF28D8567E977D1EF54350F14426ED84DC7291DF79A8408B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848F22608 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF848F226D1

Memory Dump Source

Source File: 00000000.00000002.2962948177.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5663be4f051b900296de49612e4a956c532b6edbc3549567193b4d910f284455
Instruction ID: aadfb1923dc86fe463e257c432e39dce905d491d4b03862601144a581449d2c9
Opcode Fuzzy Hash: 5663be4f051b900296de49612e4a956c532b6edbc3549567193b4d910f284455
Instruction Fuzzy Hash: 5C41F63190CA5C5FDB18EF68984A6F9BBE1EB59321F00027ED009D3292DF75A852C7C5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_32X35O1GVFF441YB_b619331d6ebfaa752cb39228ca38361cc95838_cdc271f5_2bffae22-1b23-4138-931c-592607ee6959\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96BA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER989F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER98DF.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
17138520674595629f036092083cd6f67bdbe7369638076e0b4435be55ac10762b26f7e163552.dat-decoded.exe

Function 00007FF848F29A7D Relevance: .8, Instructions: 840
COMMON

Function 00007FF848F264E6 Relevance: .5, Instructions: 472
COMMON

Function 00007FF848F27292 Relevance: .5, Instructions: 458
COMMON

Function 00007FF848F22608 Relevance: 1.6, APIs: 1, Instructions: 137
COMMON