Edit tour

Windows Analysis Report
2Jq4fZJIJ8.exe

Overview

General Information

Sample name:	2Jq4fZJIJ8.exe renamed because original name is a hash value
Original sample name:	d069c61ff3b843b2ee5165f0bac7c30693f0ee9893906f984662f04eaacbee61.exe
Analysis ID:	1632358
MD5:	93c0345871a7c67079d8d8bc5d722493
SHA1:	344872f40c4f4f04b8b20f5de290bd62b678ef40
SHA256:	d069c61ff3b843b2ee5165f0bac7c30693f0ee9893906f984662f04eaacbee61
Tags:	exeGuLoadersigneduser-adrian__luca
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious PE digital signature

Joe Sandbox ML detected suspicious sample

Sigma detected: New RUN Key Pointing to Suspicious Folder

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

2Jq4fZJIJ8.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\2Jq4fZJIJ8.exe" MD5: 93C0345871A7C67079D8D8BC5D722493)

2Jq4fZJIJ8.exe (PID: 5284 cmdline: "C:\Users\user\Desktop\2Jq4fZJIJ8.exe" MD5: 93C0345871A7C67079D8D8BC5D722493)

Dropworm.exe (PID: 804 cmdline: "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe" MD5: 93C0345871A7C67079D8D8BC5D722493)

Dropworm.exe (PID: 3796 cmdline: "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe" MD5: 93C0345871A7C67079D8D8BC5D722493)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1527552230.0000000000787000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000009.00000002.2047681752.0000000000595000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000000.00000002.1527552230.00000000007CB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000009.00000002.2047681752.0000000000538000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
00000000.00000002.1528537573.0000000006497000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000009.00000002.2049759112.0000000006017000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: 2Jq4fZJIJ8.exe PID: 7492	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Process Memory Space: Dropworm.exe PID: 804	JoeSecurity_GuLoader_3	Yara detected GuLoader	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2Jq4fZJIJ8.exe, ProcessId: 5284, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Tapestrying

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2Jq4fZJIJ8.exe, ProcessId: 5284, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Tapestrying

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:50:26.469808+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49720	38.108.185.115	443	TCP
2025-03-07T22:50:33.690204+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49722	38.108.185.115	443	TCP
2025-03-07T22:50:41.041061+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49724	38.108.185.115	443	TCP
2025-03-07T22:50:57.673014+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49727	38.108.185.115	443	TCP
2025-03-07T22:51:02.778925+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49729	38.108.185.115	443	TCP
2025-03-07T22:51:10.329816+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49731	38.108.185.115	443	TCP
2025-03-07T22:51:17.869052+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49733	38.108.185.115	443	TCP
2025-03-07T22:51:19.351809+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49734	38.108.185.115	443	TCP
2025-03-07T22:51:25.069169+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49737	38.108.185.115	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2Jq4fZJIJ8.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe

Avira: detection malicious, Label: HEUR/AGEN.1361137

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: 2Jq4fZJIJ8.exe	Virustotal: Detection: 65%			Perma Link
Source: 2Jq4fZJIJ8.exe	ReversingLabs: Detection: 52%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 2Jq4fZJIJ8.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49727 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: 2Jq4fZJIJ8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_00405FFD FindFirstFileA,FindClose,	8_2_00405FFD
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_00402688 FindFirstFileA,	8_2_00402688
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_00405FFD FindFirstFileA,FindClose,	9_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688

Source: Joe Sandbox View

IP Address: 38.108.185.115 38.108.185.115

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49722 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49733 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49729 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49734 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49720 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49724 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49727 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49737 -> 38.108.185.115:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49731 -> 38.108.185.115:443

Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49727 version: TLS 1.0

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension. HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cacheConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: od.lkCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: od.lk

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:50:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: MISSStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:50:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:50:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:50:59 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:51:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:51:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:51:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 21:51:22 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingX-Powered-By: PHP/7.4.33Cache-Control: no-cache, max-age=0, s-max-age=0, must-revalidate, no-storeError-Message: File is inaccessible due to account suspension.Error: X-FastCGI-Cache: HITStrict-Transport-Security: max-age=63072000; includeSubDomainsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniff

Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/0
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/sfig2.crt0
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfi
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldte
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfig2s1-775.crl0c
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot.crl0L
Source: Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.starfieldtex
Source: Dropworm.exe, Dropworm.exe, 00000009.00000000.1699005074.0000000000409000.00000008.00000001.01000000.0000000E.sdmp, Dropworm.exe, 00000009.00000002.2047393619.0000000000409000.00000004.00000001.01000000.0000000E.sdmp, Dropworm.exe, 0000000C.00000002.2429535829.0000000000409000.00000008.00000001.01000000.0000000E.sdmp, 2Jq4fZJIJ8.exe, Dropworm.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 2Jq4fZJIJ8.exe, Dropworm.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.star
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/08
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0F
Source: Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starfieldtechZ
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.starz
Source: Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ogp.me/ns#
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1904152654.00000000033DA000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036442740.00000000033DC000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2219815466.0000000003423000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/04c
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/211
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.2162639450.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1997320279.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2072754690.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/?
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663768139.00000000033DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/AppData
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/C
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.000000000338C000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/H
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/M:
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/T
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin)
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin-
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin.
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin2
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin:
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin=
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033A3000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binF
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binH
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.000000000338C000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binM
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binP
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1945858799.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binU
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binm
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003387000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binq
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033A3000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binr
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bins
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/em32
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2147922516.000000000342D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/l
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/o
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/od.lk/
Source: 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/or/
Source: Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://od.lk/ws
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.opendrive.com/api/
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.opendrive.com/api/branding.json?user_id=2104337
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.opendrive.com/api/download/file.json/MzdfMzIxNzQ4MzhfWGo3SW8?test=1&inline=0
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web.opendrive.com/api/file/info.json/MzdfMzIxNzQ4MzhfWGo3SW8?sharing_id=
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.opendrive.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 38.108.185.115:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageA,CreatePopupMenu,LdrInitializeThunk,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,LdrInitializeThunk,SetClipboardData,CloseClipboard,

0_2_00405050

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_004030D9
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	8_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004030D9

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	File created: C:\Windows\resources\0809			Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	File created: C:\Windows\resources\0809\Godtager22			Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_00406344	0_2_00406344
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_0040488F	0_2_0040488F
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_00406344	8_2_00406344
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_0040488F	8_2_0040488F
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_00406344	9_2_00406344
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_0040488F	9_2_0040488F

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\nseAD0E.tmp\System.dll 98BCD1DD88642F4DD36A300C76EBB1DDFBBBC5BFC7E3B6D7435DC6D6E030C13B

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: String function: 00402A3A appears 52 times

Source: 2Jq4fZJIJ8.exe

Static PE information: invalid certificate

Source: 2Jq4fZJIJ8.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/17@1/1

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_004030D9
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	8_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,LdrInitializeThunk,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,LdrInitializeThunk,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004030D9

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_0040431C GetDlgItem,SetWindowTextA,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,LdrInitializeThunk,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040431C

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_0040205E LdrInitializeThunk,CoCreateInstance,MultiByteToWideChar,LdrInitializeThunk,

0_2_0040205E

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

File created: C:\Users\user\kompatible

Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

File created: C:\Users\user\AppData\Local\Temp\nsnDDE5.tmp

Jump to behavior

Source: 2Jq4fZJIJ8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2Jq4fZJIJ8.exe	Virustotal: Detection: 65%
Source: 2Jq4fZJIJ8.exe	ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

File read: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2Jq4fZJIJ8.exe "C:\Users\user\Desktop\2Jq4fZJIJ8.exe"
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process created: C:\Users\user\Desktop\2Jq4fZJIJ8.exe "C:\Users\user\Desktop\2Jq4fZJIJ8.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe"
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process created: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe"
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process created: C:\Users\user\Desktop\2Jq4fZJIJ8.exe "C:\Users\user\Desktop\2Jq4fZJIJ8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process created: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

File written: C:\Users\user\kompatible\Sofacyklernes\disapproving.ini

Jump to behavior

Source: 2Jq4fZJIJ8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1528537573.0000000006497000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2049759112.0000000006017000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1527552230.0000000000787000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2047681752.0000000000595000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1527552230.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2047681752.0000000000538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2Jq4fZJIJ8.exe PID: 7492, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dropworm.exe PID: 804, type: MEMORYSTR

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Persistence and Installation Behavior

AI detected suspicious PE digital signature

Source: Initial sample

Joe Sandbox AI: Detected suspicious elements in PE signature: Multiple highly suspicious indicators: 1) Self-signed certificate (issuer same as subject) which is not trusted by system providers 2) Suspicious email domain 'Rdjet116.Ko' appears non-standard and likely fraudulent 3) Organization 'Waterloos' is not a known legitimate company 4) Large time gap between compilation date (2016) and certificate creation (2024) suggests possible certificate manipulation 5) The OU field 'Methodistic Mtaalighed' contains unusual/nonsensical terms 6) While US location is used, the combination of other suspicious elements suggests location spoofing 7) Certificate signature is explicitly marked as invalid by the system 8) The email format 'Rumored@' is highly unusual for a legitimate business certificate

Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	File created: C:\Users\user\AppData\Local\Temp\nseAD0E.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	File created: C:\Users\user\AppData\Local\Temp\nsmE7DA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	File created: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Jump to dropped file

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Tapestrying	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Tapestrying	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Tapestrying	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Tapestrying	Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	API/Special instruction interceptor: Address: 68928D4
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	API/Special instruction interceptor: Address: 26528D4
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	API/Special instruction interceptor: Address: 64128D4
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	API/Special instruction interceptor: Address: 26528D4

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	RDTSC instruction interceptor: First address: 6846AAD second address: 6846AAD instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F5A2874B231h 0x00000006 cmp dl, FFFFFFE3h 0x00000009 inc ebp 0x0000000a cmp edx, 4AB459DCh 0x00000010 inc ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	RDTSC instruction interceptor: First address: 2606AAD second address: 2606AAD instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F5A28C3C7A1h 0x00000006 cmp dl, FFFFFFE3h 0x00000009 inc ebp 0x0000000a cmp edx, 4AB459DCh 0x00000010 inc ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	RDTSC instruction interceptor: First address: 63C6AAD second address: 63C6AAD instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F5A2874B231h 0x00000006 cmp dl, FFFFFFE3h 0x00000009 inc ebp 0x0000000a cmp edx, 4AB459DCh 0x00000010 inc ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	RDTSC instruction interceptor: First address: 2606AAD second address: 2606AAD instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007F5A28C3C7A1h 0x00000006 cmp dl, FFFFFFE3h 0x00000009 inc ebp 0x0000000a cmp edx, 4AB459DCh 0x00000010 inc ebx 0x00000011 rdtsc

Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nseAD0E.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsmE7DA.tmp\System.dll			Jump to dropped file

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe TID: 2876	Thread sleep time: -120000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe TID: 7908	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_00405FFD FindFirstFileA,FindClose,	0_2_00405FFD
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040559B
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 0_2_00402688 FindFirstFileA,	0_2_00402688
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_00405FFD FindFirstFileA,FindClose,	8_2_00405FFD
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_00402688 FindFirstFileA,	8_2_00402688
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Code function: 8_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	8_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_00405FFD FindFirstFileA,FindClose,	9_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Code function: 9_2_00402688 FindFirstFileA,	9_2_00402688

Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003387000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWHtA
Source: Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.000000000338C000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	API call chain: ExitProcess graph end node	graph_0-4791
Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	API call chain: ExitProcess graph end node	graph_0-4788
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	API call chain: ExitProcess graph end node	graph_9-3692
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	API call chain: ExitProcess graph end node	graph_9-3696

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

0_2_00405050

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe	Process created: C:\Users\user\Desktop\2Jq4fZJIJ8.exe "C:\Users\user\Desktop\2Jq4fZJIJ8.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	Process created: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe "C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe"			Jump to behavior

Source: C:\Users\user\Desktop\2Jq4fZJIJ8.exe

Code function: 0_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D1B

Source: C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2Jq4fZJIJ8.exe	65%	Virustotal		Browse
2Jq4fZJIJ8.exe	53%	ReversingLabs	Win32.Trojan.GuLoader
2Jq4fZJIJ8.exe	100%	Avira	HEUR/AGEN.1361137

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	100%	Avira	HEUR/AGEN.1361137
C:\Users\user\AppData\Local\Temp\Kunderegistrets\Dropworm.exe	53%	ReversingLabs	Win32.Trojan.GuLoader
C:\Users\user\AppData\Local\Temp\nseAD0E.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsmE7DA.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.starfieldtechZ	0%	Avira URL Cloud	safe
http://crl.starfi	0%	Avira URL Cloud	safe
https://www.opendrive.com	0%	Avira URL Cloud	safe
http://ocsp.starz	0%	Avira URL Cloud	safe
http://crl.starfieldte	0%	Avira URL Cloud	safe
http://crl.starfieldtex	0%	Avira URL Cloud	safe
http://ocsp.star	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
od.lk	38.108.185.115	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bin	false		high
https://od.lk/f/MzdfMzIxNzQ4MzhfWGo3SW8?file_error=File+is+inaccessible+due+to+account+suspension.	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://web.opendrive.com/api/branding.json?user_id=2104337	2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binm	Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://certs.starfieldtech.com/repository/0	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false		high
http://certificates.starfieldtech.com/repository/0	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.starfieldtechZ	Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binq	Dropworm.exe, 0000000C.00000002.2433018640.0000000003387000.00000004.00000020.00020000.00000000.sdmp	false		high
https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.binr	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033A3000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://od.lk/d/MzdfMzIxNzQ4Mzhf/WbUFEtl105.bins	Dropworm.exe, 0000000C.00000002.2433018640.00000000033C4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://od.lk/or/	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.opendrive.com/api/file/info.json/MzdfMzIxNzQ4MzhfWGo3SW8?sharing_id=	2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.starfieldtech.com/sfig2s1-775.crl0c	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.starfieldtech.com/08	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false		high
https://od.lk/l	Dropworm.exe, 0000000C.00000002.2433018640.0000000003412000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.opendrive.com	2Jq4fZJIJ8.exe, 00000008.00000003.1971631485.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1663721780.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2036334999.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1817986444.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2136016965.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.1753723572.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000003.2194439736.00000000033CF000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000003.2178764189.000000000341C000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/0;	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.0000000003423000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.opendrive.com/api/	2Jq4fZJIJ8.exe, 00000008.00000003.1904180717.00000000033C6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433540354.00000000050C0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://od.lk/o	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.starfieldtech.com/0F	2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.000000000341A000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.0000000003368000.00000004.00000020.00020000.00000000.sdmp, 2Jq4fZJIJ8.exe, 00000008.00000002.2432572239.00000000033D6000.00000004.00000020.00020000.00000000.sdmp, Dropworm.exe, 0000000C.00000002.2433018640.000000000342F000.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2Jq4fZJIJ8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Windows Analysis Report
2Jq4fZJIJ8.exe