Windows Analysis Report
Payment Swift.doc

Overview

General Information

Sample name: Payment Swift.doc
Analysis ID: 1431944
MD5: 67fea5000046ad95ddf9707506002eaa
SHA1: b41f04ef65206c9f0305cc0b124dc9a58f1fe0aa
SHA256: b8fa7245705f07d10b2f028be43ba688ca78ddc224665a2da85d529c124725b1
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected AgentTesla
.NET source code references suspicious native API functions
Contains functionality to log keystrokes (.Net Source)
Document exploit detected (process start blacklist hit)
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Installs a global keyboard hook
Installs new ROOT certificates
Machine Learning detection for dropped file
Office equation editor drops PE file
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Equation Editor Network Connection
Sigma detected: Suspicious Microsoft Office Child Process
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: SCR File Write Event
Sigma detected: Suspicious DNS Query for IP Lookup Service APIs
Sigma detected: Suspicious Screensaver Binary File Creation
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://covid19help.top/microm.scrj Avira URL Cloud: Label: malware
Source: https://covid19help.top/microm.scrC: Avira URL Cloud: Label: malware
Source: https://covid19help.top/microm.scr Avira URL Cloud: Label: phishing
Source: https://covid19help.top/t Avira URL Cloud: Label: malware
Source: https://covid19help.top/microm.scrkkC: Avira URL Cloud: Label: malware
Source: https://covid19help.top/microm.scrY Avira URL Cloud: Label: malware
Found malware configuration
Source: 5.2.microme09255.scr.344a420.5.raw.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.gmail.com", "Username": "micromeqbd@gmail.com", "Password": "tssveohxktcpzhdm"}
Multi AV Scanner detection for domain / URL
Source: covid19help.top Virustotal: Detection: 24% Perma Link
Source: https://covid19help.top/microm.scr Virustotal: Detection: 21% Perma Link
Multi AV Scanner detection for submitted file
Source: Payment Swift.doc ReversingLabs: Detection: 43%
Source: Payment Swift.doc Virustotal: Detection: 45% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microm[1].scr Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\microme09255.scr Joe Sandbox ML: detected

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 104.21.83.128 Port: 443 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\microme09255.scr
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\microme09255.scr Jump to behavior
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.22:49162 version: TLS 1.2
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: microme09255.scr, 00000005.00000002.348544360.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, microme09255.scr, 00000005.00000002.348261996.0000000000230000.00000004.08000000.00040000.00000000.sdmp

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: covid19help.top
Source: global traffic DNS query: name: api.ipify.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 104.21.83.128:443 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 104.21.83.128:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 172.67.74.152:443 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 172.67.74.152:443
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.21.83.128 104.21.83.128
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View IP Address: 172.67.74.152 172.67.74.152
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1
May check the online IP address of the machine
Source: C:\Users\user\AppData\Roaming\microme09255.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\microme09255.scr DNS query: name: api.ipify.org
Source: C:\Users\user\AppData\Roaming\microme09255.scr DNS query: name: api.ipify.org
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /microm.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F049A0BE-DDAA-4F28-9F33-B6FAFB134366}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /microm.scr HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: covid19help.topConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: covid19help.top
Source: global traffic DNS traffic detected: DNS query: api.ipify.org
Source: microme09255.scr, 00000006.00000002.883885788.000000000237E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://api.ipify.org
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.0000000005A1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: EQNEDT32.EXE, 00000002.00000003.346877641.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.347780884.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.0000000005A1B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: EQNEDT32.EXE, 00000002.00000003.346863072.000000000426C000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-secureconversation/200512/dk/p_sha1
Source: microme09255.scr.2.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform0Tran
Source: microme09255.scr.2.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: EQNEDT32.EXE, 00000002.00000003.346877641.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.347780884.0000000000632000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/anonymous
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecision
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/country
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthxhttp://schemas.xmlsoap.org/ws/2005
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthyhttp://schemas.xmlsoap.org/ws/2005
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidrhttp://schemas.xmlsoap.org/ws/2005
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidshttp://schemas.xmlsoap.org/ws/2005
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressthttp://schemas.xmlsoap.org/ws/200
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressuhttp://schemas.xmlsoap.org/ws/200
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/homephone
Source: microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: microme09255.scr, 00000006.00000002.883885788.00000000022C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcode
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcodezhttp://schemas.xmlsoap.org/ws/2005/
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifierzhttp://schemas.xmlso
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddress
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintshttp://schemas.xmlsoap.org/ws/2005/
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/webpage
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishedname~http://schemas.xmlsoap.o
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims~http://schemas.xmlsoap.org/ws/2005/05/identity
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/identity
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/rightzhttp://schemas.xmlsoap.org/ws/2005/05/identity/
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: microme09255.scr, 00000005.00000002.348615893.000000000339A000.00000004.00000800.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.883629068.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://account.dyn.com/
Source: microme09255.scr, 00000005.00000002.348615893.000000000339A000.00000004.00000800.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.883885788.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.883629068.0000000000402000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org
Source: microme09255.scr, 00000006.00000002.883885788.00000000022C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/
Source: microme09255.scr, 00000006.00000002.883885788.00000000022C1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ipify.org/t
Source: EQNEDT32.EXE, 00000002.00000003.346877641.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.347780884.00000000005FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/microm.scr
Source: EQNEDT32.EXE, 00000002.00000003.346877641.0000000000632000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/microm.scrC:
Source: EQNEDT32.EXE, 00000002.00000002.347780884.00000000005FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/microm.scrY
Source: EQNEDT32.EXE, 00000002.00000002.347780884.00000000005FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/microm.scrj
Source: EQNEDT32.EXE, 00000002.00000002.347780884.00000000005FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/microm.scrkkC:
Source: EQNEDT32.EXE, 00000002.00000003.346877641.000000000061B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://covid19help.top/t
Source: EQNEDT32.EXE, 00000002.00000003.346877641.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.347780884.0000000000632000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000002.348086913.000000000066A000.00000004.00000020.00020000.00000000.sdmp, EQNEDT32.EXE, 00000002.00000003.346867219.0000000000663000.00000004.00000020.00020000.00000000.sdmp, microme09255.scr, 00000006.00000002.884220115.00000000059F0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown HTTPS traffic detected: 104.21.83.128:443 -> 192.168.2.22:49161 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.22:49162 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality to log keystrokes (.Net Source)
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, A1HZ.cs .Net Code: _5O4
Installs a global keyboard hook
Source: C:\Users\user\AppData\Roaming\microme09255.scr Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\microme09255.scr Jump to behavior

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Payment Swift.doc, type: SAMPLE Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 5.2.microme09255.scr.47c0000.7.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.microme09255.scr.332dd90.4.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.microme09255.scr.344a420.5.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.microme09255.scr.47c0000.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 6.2.microme09255.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.microme09255.scr.340f9f0.6.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.microme09255.scr.332dd90.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.microme09255.scr.22cf214.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 5.2.microme09255.scr.340f9f0.6.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.microme09255.scr.22d1a54.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000005.00000002.348836350.00000000047C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Detects downloader injector Author: ditekSHen
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable editing from the yellow bar above.The independent auditors' opinion says the financial state
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\microme09255.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microm[1].scr Jump to dropped file
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process Stats: CPU usage > 49%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 5_2_001C3D2F 5_2_001C3D2F
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00393900 6_2_00393900
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_0039F360 6_2_0039F360
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00398C00 6_2_00398C00
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00394518 6_2_00394518
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_0039BE88 6_2_0039BE88
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00393C48 6_2_00393C48
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_0039E54A 6_2_0039E54A
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00920980 6_2_00920980
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_009255F0 6_2_009255F0
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00926550 6_2_00926550
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00921A40 6_2_00921A40
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 6_2_00928778 6_2_00928778
Yara signature match
Source: Payment Swift.doc, type: SAMPLE Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 5.2.microme09255.scr.47c0000.7.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.microme09255.scr.332dd90.4.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.microme09255.scr.344a420.5.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.microme09255.scr.47c0000.7.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 6.2.microme09255.scr.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.microme09255.scr.340f9f0.6.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.microme09255.scr.332dd90.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.microme09255.scr.22cf214.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.microme09255.scr.340f9f0.6.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.microme09255.scr.22d1a54.3.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000005.00000002.348836350.00000000047C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, YsTq4S.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, YsTq4S.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, ZNczHvI78.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, G2Tmmpnyphl.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, G2Tmmpnyphl.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.microme09255.scr.332dd90.4.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 5.2.microme09255.scr.47c0000.7.raw.unpack, DarkComboBox.cs Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: microme09255.scr, 00000005.00000000.346915101.0000000000DE2000.00000020.00000001.01000000.00000004.sdmp, microm[1].scr.2.dr, microme09255.scr.2.dr Binary or memory string: 9NHY9.vBP_AKdRKKcR
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winDOC@7/9@2/2
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$yment Swift.doc Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVR63A2.tmp Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Payment Swift.doc ReversingLabs: Detection: 43%
Source: Payment Swift.doc Virustotal: Detection: 45%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr"
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr"
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr" Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: credssp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ncrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: bcrypt.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: bcrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: wbemcomn2.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: credssp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Section loaded: vaultcli.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Payment Swift.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\Payment Swift.doc
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: microme09255.scr, 00000005.00000002.348544360.00000000022C1000.00000004.00000800.00020000.00000000.sdmp, microme09255.scr, 00000005.00000002.348261996.0000000000230000.00000004.08000000.00040000.00000000.sdmp
Binary contains a suspicious time stamp
Source: microm[1].scr.2.dr Static PE information: 0xF0D93282 [Fri Jan 17 03:01:22 2098 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00607A67 push esp; ret 2_2_00607A6B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00607A6F push esp; ret 2_2_00607A73
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00607A77 push esp; ret 2_2_00607A7B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060FA7E push esi; ret 2_2_0060FA7F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00605452 push esi; ret 2_2_00605453
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0061002A push esp; ret 2_2_0061002B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00610032 push esp; ret 2_2_00610033
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060A8F2 push ebp; ret 2_2_0060A8F3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060A8FA push ebp; ret 2_2_0060A8FB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060F8AA push esi; ret 2_2_0060F8AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060F8B2 push esi; ret 2_2_0060F8B3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_006052BE push esi; ret 2_2_006052BF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060FA86 push esi; ret 2_2_0060FA87
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00608366 push esp; ret 2_2_00608367
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060836E push esp; ret 2_2_0060836F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00608979 push esi; ret 2_2_0060897B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00606D25 push esi; ret 2_2_00606D27
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00606D1D push esi; ret 2_2_00606D1F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00605FE2 push esi; ret 2_2_00605FE3
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00605FEA push esi; ret 2_2_00605FEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060C3AA push esp; ret 2_2_0060C3AB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00608981 push esi; ret 2_2_00608983
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0060658E push esp; ret 2_2_0060658F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_00606596 push esp; ret 2_2_00606597
Source: C:\Users\user\AppData\Roaming\microme09255.scr Code function: 5_2_001C07C8 pushad ; retn 0017h 5_2_001C07E1
Source: microm[1].scr.2.dr Static PE information: section name: .text entropy: 7.181612006870042
Source: microme09255.scr.2.dr Static PE information: section name: .text entropy: 7.181612006870042

Persistence and Installation Behavior
barindex
Drops PE files with a suspicious file extension
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\microme09255.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microm[1].scr Jump to dropped file
Installs new ROOT certificates
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\microme09255.scr Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\microm[1].scr Jump to dropped file
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT Jump to behavior
Stores large binary data to the registry
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\microme09255.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 1C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 22C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 900000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 390000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 22C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: 9E0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 1200000 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\microme09255.scr Window / User API: threadDelayed 9831 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2852 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr TID: 3196 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr TID: 3252 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr TID: 3320 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr TID: 3320 Thread sleep time: -6000000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr TID: 3324 Thread sleep count: 9831 > 30 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3440 Thread sleep time: -180000s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\microme09255.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Roaming\microme09255.scr WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Thread delayed: delay time: 1200000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: 5.2.microme09255.scr.230000.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.microme09255.scr.230000.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 5.2.microme09255.scr.230000.0.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)
Source: 5.2.microme09255.scr.344a420.5.raw.unpack, Qy2X.cs Reference to suspicious API methods: ljK.OpenProcess(zK2m4hVdZK5.DuplicateHandle, bInheritHandle: true, (uint)eUXyuV2.ProcessID)
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\microme09255.scr Memory written: C:\Users\user\AppData\Roaming\microme09255.scr base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr" Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Process created: C:\Users\user\AppData\Roaming\microme09255.scr "C:\Users\user\AppData\Roaming\microme09255.scr" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\microme09255.scr Queries volume information: C:\Users\user\AppData\Roaming\microme09255.scr VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Queries volume information: C:\Users\user\AppData\Roaming\microme09255.scr VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.microme09255.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.883629068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.348615893.000000000339A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3204, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\FTP Navigator\Ftplist.txt Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Source: C:\Users\user\AppData\Roaming\microme09255.scr Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.microme09255.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.883629068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.883885788.0000000002310000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.348615893.000000000339A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3204, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.microme09255.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.344a420.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.microme09255.scr.340f9f0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.883629068.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.348615893.000000000339A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: microme09255.scr PID: 3204, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1431944 Sample: Payment Swift.doc Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 38 Multi AV Scanner detection for domain / URL 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 13 other signatures 2->44 8 WINWORD.EXE 336 13 2->8         started        process3 process4 10 EQNEDT32.EXE 11 8->10         started        15 EQNEDT32.EXE 8->15         started        dnsIp5 30 covid19help.top 104.21.83.128, 443, 49161 CLOUDFLARENETUS United States 10->30 24 C:\Users\user\AppData\...\microme09255.scr, PE32 10->24 dropped 26 C:\Users\user\AppData\Local\...\microm[1].scr, PE32 10->26 dropped 54 Installs new ROOT certificates 10->54 56 Office equation editor establishes network connection 10->56 58 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->58 17 microme09255.scr 2 10->17         started        file6 signatures7 process8 signatures9 32 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 17->32 34 Machine Learning detection for dropped file 17->34 36 Injects a PE file into a foreign processes 17->36 20 microme09255.scr 12 2 17->20         started        process10 dnsIp11 28 api.ipify.org 172.67.74.152, 443, 49162 CLOUDFLARENETUS United States 20->28 46 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->46 48 Tries to steal Mail credentials (via file / registry access) 20->48 50 Tries to harvest and steal ftp login credentials 20->50 52 2 other signatures 20->52 signatures12
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.83.128
 covid19help.top United States
13335 CLOUDFLARENETUS true
172.67.74.152
 api.ipify.org United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
covid19help.top 104.21.83.128 true
api.ipify.org 172.67.74.152 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://covid19help.top/microm.scr true
  • 22%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown
https://api.ipify.org/ false
    		high