Edit tour

Windows Analysis Report
oCPGyn28rc.exe

Overview

General Information

Sample name:	oCPGyn28rc.exe renamed because original name is a hash value
Original sample name:	0091db5e3fa6269fa2ad8b54f797334f142678fd78b7099063c3ece593e9fc1f.exe
Analysis ID:	1631773
MD5:	21005adbeddc7ca0f5cf6d0aa9fbe39a
SHA1:	7134844a16b7e7c07b18765e405af39ebf969238
SHA256:	0091db5e3fa6269fa2ad8b54f797334f142678fd78b7099063c3ece593e9fc1f
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AgentTesla

Yara detected AntiVM3

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops VBS files to the startup folder

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

oCPGyn28rc.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\oCPGyn28rc.exe" MD5: 21005ADBEDDC7CA0F5CF6D0AA9FBE39A)

Citlaltpetl.exe (PID: 6812 cmdline: "C:\Users\user\Desktop\oCPGyn28rc.exe" MD5: 21005ADBEDDC7CA0F5CF6D0AA9FBE39A)

RegSvcs.exe (PID: 6900 cmdline: "C:\Users\user\Desktop\oCPGyn28rc.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 2772 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Citlaltpetl.exe (PID: 5404 cmdline: "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe" MD5: 21005ADBEDDC7CA0F5CF6D0AA9FBE39A)

RegSvcs.exe (PID: 5224 cmdline: "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.daipro.com.mx", "Username": "contabilidad@daipro.com.mx", "Password": "DAIpro123**"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3418f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34201:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3431d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34387:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3448f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3451f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3418f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34201:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3431d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34387:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3448f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3451f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000006.00000002.3499965482.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 6812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 6812	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 6812	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6900	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 5404	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 5404	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Citlaltpetl.exe PID: 5404	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 5224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5224	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3418f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34201:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3431d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34387:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3448f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3451f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.Citlaltpetl.exe.ef0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Citlaltpetl.exe.ef0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.Citlaltpetl.exe.ef0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3418f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34201:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3431d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34387:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3448f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3451f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
5.2.Citlaltpetl.exe.ef0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Citlaltpetl.exe.ef0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.Citlaltpetl.exe.ef0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3238f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32401:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3248b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3251d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32587:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3268f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3271f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.Citlaltpetl.exe.2bf0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Citlaltpetl.exe.2bf0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Citlaltpetl.exe.2bf0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3238f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32401:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3248b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3251d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32587:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3268f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3271f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3418f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34201:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3428b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3431d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34387:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3448f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3451f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4076, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , ProcessId: 2772, ProcessName: wscript.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 144.217.198.22, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 5224, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4076, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs" , ProcessId: 2772, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe, ProcessId: 6812, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: oCPGyn28rc.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe

Avira: detection malicious, Label: TR/AD.GenSteal.mluwh

Found malware configuration

Source: 5.2.Citlaltpetl.exe.ef0000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.daipro.com.mx", "Username": "contabilidad@daipro.com.mx", "Password": "DAIpro123**"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: oCPGyn28rc.exe	Virustotal: Detection: 70%			Perma Link
Source: oCPGyn28rc.exe	ReversingLabs: Detection: 65%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: oCPGyn28rc.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: Citlaltpetl.exe, 00000002.00000003.1082199932.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000002.00000003.1080904872.00000000034A0000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000003.1199119266.0000000003930000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000003.1197208710.0000000003410000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Citlaltpetl.exe, 00000002.00000003.1082199932.0000000003640000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000002.00000003.1080904872.00000000034A0000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000003.1199119266.0000000003930000.00000004.00001000.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000003.1197208710.0000000003410000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E34696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00E34696
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00E3C9C7
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3C93C FindFirstFileW,FindClose,	0_2_00E3C93C
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E3F200
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00E3F35D
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E3F65E
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E33A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E33A2B
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E33D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00E33D4E
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00E3BF27
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00614696 GetFileAttributesW,FindFirstFileW,FindClose,	2_2_00614696
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061C93C FindFirstFileW,FindClose,	2_2_0061C93C
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0061C9C7
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0061F200
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0061F35D
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0061F65E
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00613A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00613A2B
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00613D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00613D4E
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0061BF27

Source: global traffic

TCP traffic: 192.168.2.11:49708 -> 144.217.198.22:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.11:49708 -> 144.217.198.22:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\oCPGyn28rc.exe

Code function: 0_2_00E425E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00E425E2

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.daipro.com.mx

Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: RegSvcs.exe, 00000006.00000002.3499965482.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://daipro.com.mx
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003054000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000002F9D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Citlaltpetl.exe, 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000003054000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000002F9D000.00000004.00000800.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000006.00000002.3499965482.0000000002A19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.daipro.com.mx
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3499965482.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Citlaltpetl.exe, 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003028000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipif8
Source: Citlaltpetl.exe, 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp, Citlaltpetl.exe, 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3499965482.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000002F51000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.3499965482.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/TR
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/p
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: RegSvcs.exe, 00000003.00000002.1203762555.0000000003030000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgD

Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, 8AYyiOU7.cs	.Net Code: rmF
Source: 5.2.Citlaltpetl.exe.ef0000.1.raw.unpack, 8AYyiOU7.cs	.Net Code: rmF

Source: C:\Users\user\Desktop\oCPGyn28rc.exe

Code function: 0_2_00E4425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00E4425A

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E44458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_00E44458
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00624458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		2_2_00624458

Source: C:\Users\user\Desktop\oCPGyn28rc.exe

0_2_00E4425A

Source: C:\Users\user\Desktop\oCPGyn28rc.exe

Code function: 0_2_00E30219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00E30219

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E5CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_00E5CDAC
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0063CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_0063CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.Citlaltpetl.exe.ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 5.2.Citlaltpetl.exe.ef0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Citlaltpetl.exe.2bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00DD3B4C
Source: oCPGyn28rc.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: oCPGyn28rc.exe, 00000000.00000002.1056418518.0000000000E85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_10a96127-7
Source: oCPGyn28rc.exe, 00000000.00000002.1056418518.0000000000E85000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e1560209-e
Source: oCPGyn28rc.exe, 00000000.00000003.1053574055.0000000003F55000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_81087d3d-c
Source: oCPGyn28rc.exe, 00000000.00000003.1053574055.0000000003F55000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_38c05198-a
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: This is a third-party compiled AutoIt script.	2_2_005B3B4C
Source: Citlaltpetl.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Citlaltpetl.exe, 00000002.00000000.1054168315.0000000000665000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3d6ee2a3-4
Source: Citlaltpetl.exe, 00000002.00000000.1054168315.0000000000665000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8fb94d72-3
Source: Citlaltpetl.exe, 00000005.00000000.1172971282.0000000000665000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f37a1b28-8
Source: Citlaltpetl.exe, 00000005.00000000.1172971282.0000000000665000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8f54ad17-a
Source: oCPGyn28rc.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_18506d59-4
Source: oCPGyn28rc.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ec42d489-6
Source: Citlaltpetl.exe.0.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dee28185-2
Source: Citlaltpetl.exe.0.dr	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_74dd0031-f

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E3545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		0_2_00E3545F
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0061545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		2_2_0061545F

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DDE800	0_2_00DDE800
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFDBB5	0_2_00DFDBB5
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DDFE40	0_2_00DDFE40
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E5804A	0_2_00E5804A
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DDE060	0_2_00DDE060
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE4140	0_2_00DE4140
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF2405	0_2_00DF2405
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E06522	0_2_00E06522
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E50665	0_2_00E50665
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E0267E	0_2_00E0267E
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE6843	0_2_00DE6843
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF283A	0_2_00DF283A
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E089DF	0_2_00E089DF
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E50AE2	0_2_00E50AE2
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E06A94	0_2_00E06A94
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE8A0E	0_2_00DE8A0E
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E2EB07	0_2_00E2EB07
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E38B13	0_2_00E38B13
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFCD61	0_2_00DFCD61
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E07006	0_2_00E07006
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE3190	0_2_00DE3190
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE710E	0_2_00DE710E
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DD1287	0_2_00DD1287
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF33C7	0_2_00DF33C7
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF16C4	0_2_00DF16C4
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE5680	0_2_00DE5680
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DE58C0	0_2_00DE58C0
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF1BB8	0_2_00DF1BB8
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF1FD0	0_2_00DF1FD0
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFBFE6	0_2_00DFBFE6
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_0183FBD8	0_2_0183FBD8
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005BE800	2_2_005BE800
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DDBB5	2_2_005DDBB5
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005BFE40	2_2_005BFE40
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0063804A	2_2_0063804A
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005BE060	2_2_005BE060
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C4140	2_2_005C4140
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D2405	2_2_005D2405
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E6522	2_2_005E6522
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00630665	2_2_00630665
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E267E	2_2_005E267E
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C6843	2_2_005C6843
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D283A	2_2_005D283A
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E89DF	2_2_005E89DF
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C8A0E	2_2_005C8A0E
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00630AE2	2_2_00630AE2
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E6A94	2_2_005E6A94
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_0060EB07	2_2_0060EB07
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00618B13	2_2_00618B13
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DCD61	2_2_005DCD61
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E7006	2_2_005E7006
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C710E	2_2_005C710E
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C3190	2_2_005C3190
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005B1287	2_2_005B1287
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D33C7	2_2_005D33C7
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DF419	2_2_005DF419
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D16C4	2_2_005D16C4
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C5680	2_2_005C5680
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D78D3	2_2_005D78D3
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005C58C0	2_2_005C58C0
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D1BB8	2_2_005D1BB8
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005E9D05	2_2_005E9D05
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D1FD0	2_2_005D1FD0
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DBFE6	2_2_005DBFE6
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00C316C8	2_2_00C316C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_014F41F8	3_2_014F41F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_014FB7B0	3_2_014FB7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_014FAB38	3_2_014FAB38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_014F4AC8	3_2_014F4AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_014F3EB0	3_2_014F3EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06C22358	3_2_06C22358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06C20040	3_2_06C20040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06C20021	3_2_06C20021
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 5_2_011C4620	5_2_011C4620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E8B7B0	6_2_00E8B7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E84AC8	6_2_00E84AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E8EA38	6_2_00E8EA38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E83EB0	6_2_00E83EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E841F8	6_2_00E841F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06672358	6_2_06672358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06677960	6_2_06677960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0667C168	6_2_0667C168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_066761D0	6_2_066761D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06675180	6_2_06675180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06677280	6_2_06677280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0667E388	6_2_0667E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06670040	6_2_06670040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_066758D0	6_2_066758D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06670006	6_2_06670006

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: String function: 00DD7F41 appears 35 times
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: String function: 00DF0D27 appears 70 times
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: String function: 00DF8B40 appears 42 times
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: String function: 005D0D27 appears 70 times
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: String function: 005B7F41 appears 35 times
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: String function: 005D8B40 appears 42 times

Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.Citlaltpetl.exe.ef0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 5.2.Citlaltpetl.exe.ef0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Citlaltpetl.exe.2bf0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, pedwBeAo9.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, Mi6W.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, s0nDliRGT.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, UGDeyt2ww1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, xpue.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, u4JW9.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, EBT4fOCjU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, EBT4fOCjU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, EBT4fOCjU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, EBT4fOCjU.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E28713 AdjustTokenPrivileges,CloseHandle,	0_2_00E28713
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E28CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00E28CC3
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00608713 AdjustTokenPrivileges,CloseHandle,	2_2_00608713
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00608CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_00608CC3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: unknown	Process created: C:\Users\user\Desktop\oCPGyn28rc.exe "C:\Users\user\Desktop\oCPGyn28rc.exe"
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Process created: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe "C:\Users\user\Desktop\oCPGyn28rc.exe"
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\oCPGyn28rc.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Citlaltpetl.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe"
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe"
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Process created: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe "C:\Users\user\Desktop\oCPGyn28rc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\oCPGyn28rc.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe"	Jump to behavior

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: wldp.dll	Jump to behavior

Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: oCPGyn28rc.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: oCPGyn28rc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: oCPGyn28rc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: oCPGyn28rc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: oCPGyn28rc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: oCPGyn28rc.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DF8B85 push ecx; ret	0_2_00DF8B98
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFF778 push esp; retf	0_2_00DFF780
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFFDA8 push esp; retf	0_2_00DFFDA9
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005D8B85 push ecx; ret	2_2_005D8B98
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00C31DFC push ebx; retf	2_2_00C31E00
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 5_2_011C4D24 push ebx; retf	5_2_011C4D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_00E8AB38 push eax; retf	6_2_00E8AE99

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DD4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00DD4A35
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00E555FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00E555FD
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005B4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_005B4A35
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_006355FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_006355FD

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Yara match	File source: Process Memory Space: Citlaltpetl.exe PID: 6812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Citlaltpetl.exe PID: 5404, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	API/Special instruction interceptor: Address: C312EC
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	API/Special instruction interceptor: Address: 11C4244

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599887	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599638	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599379	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597892	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598186	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598073	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597729	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597619	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594520	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 593547	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1581	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2116	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2292	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7538	Jump to behavior

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-100214
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	API coverage: 4.8 %
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	API coverage: 5.0 %

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report oCPGyn28rc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
oCPGyn28rc.exe

Source: RegSvcs.exe, 00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: wscript.exe, 00000004.00000002.1174992727.0000023E2EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Citlaltpetl.exe, 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: wscript.exe, 00000004.00000002.1174992727.0000023E2EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RegSvcs.exe, 00000003.00000002.1205480532.0000000006200000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll(
Source: RegSvcs.exe, 00000006.00000002.3501974984.0000000005CC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_0183E448 mov eax, dword ptr fs:[00000030h]	0_2_0183E448
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_0183FAC8 mov eax, dword ptr fs:[00000030h]	0_2_0183FAC8
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_0183FA68 mov eax, dword ptr fs:[00000030h]	0_2_0183FA68
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00C315B8 mov eax, dword ptr fs:[00000030h]	2_2_00C315B8
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00C31558 mov eax, dword ptr fs:[00000030h]	2_2_00C31558
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_00C2FF38 mov eax, dword ptr fs:[00000030h]	2_2_00C2FF38
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 5_2_011C4510 mov eax, dword ptr fs:[00000030h]	5_2_011C4510
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 5_2_011C2E90 mov eax, dword ptr fs:[00000030h]	5_2_011C2E90
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 5_2_011C44B0 mov eax, dword ptr fs:[00000030h]	5_2_011C44B0

Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DFA395
Source: C:\Users\user\Desktop\oCPGyn28rc.exe	Code function: 0_2_00DFA364 SetUnhandledExceptionFilter,	0_2_00DFA364
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DA364 SetUnhandledExceptionFilter,	2_2_005DA364
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Code function: 2_2_005DA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_005DA395

Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D45008			Jump to behavior
Source: C:\Users\user\AppData\Local\pluff\Citlaltpetl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 9F7008			Jump to behavior

Source: oCPGyn28rc.exe, Citlaltpetl.exe.0.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: oCPGyn28rc.exe, Citlaltpetl.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Citlaltpetl.exe.ef0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Citlaltpetl.exe.ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Citlaltpetl.exe.2bf0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Citlaltpetl.exe.2bf0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1200036913.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1199644573.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1085144635.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3499965482.0000000002A19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3499965482.00000000029ED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Citlaltpetl.exe PID: 6812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Citlaltpetl.exe PID: 5404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5224, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior