Edit tour

Windows Analysis Report
RbCSdRdU5F.exe

Overview

General Information

Sample name:	RbCSdRdU5F.exe renamed because original name is a hash value
Original sample name:	dba844b00d59c245382b87ce7441a86c23df76cd517c5a291e91e76ecb8b7873.exe
Analysis ID:	1638139
MD5:	ab66a0f09e2d38da41b282658794f9d6
SHA1:	4d1c639e9350ca196dd464244a96089b005065cd
SHA256:	dba844b00d59c245382b87ce7441a86c23df76cd517c5a291e91e76ecb8b7873
Tags:	exeInfinixTechnologiesuser-JAMESWT_MHT
Infos:

Detection

Score:	78
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Joe Sandbox ML detected suspicious sample

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

RbCSdRdU5F.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\RbCSdRdU5F.exe" MD5: AB66A0F09E2D38DA41B282658794F9D6)

cmd.exe (PID: 8000 cmdline: "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

expand.exe (PID: 6832 cmdline: expand Panic.potx Panic.potx.bat MD5: 544B0DBFF3F393BCE8BB9D815F532D51)

tasklist.exe (PID: 8184 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7200 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6728 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6776 cmdline: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1812 cmdline: cmd /c md 70410 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 1488 cmdline: extrac32 /Y /E Apple.potx MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7972 cmdline: findstr /V "ALIGN" Installation MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6040 cmdline: cmd /c copy /b 70410\Fault.com + Contains + Faith + Trackback + Yang + Podcasts + Leaving + Newport + Searched + Accepts + Namely + Food 70410\Fault.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 2140 cmdline: cmd /c copy /b ..\Nsw.potx + ..\Army.potx + ..\Administrative.potx + ..\Calculations.potx + ..\Simultaneously.potx + ..\Closely.potx + ..\Nationwide.potx + ..\Ton.potx J MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Fault.com (PID: 2044 cmdline: Fault.com J MD5: 62D09F076E6E0240548C2F837536A46A)

cmd.exe (PID: 8036 cmdline: cmd /c schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2736 cmdline: schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 7200 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 3140 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 6296 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

InnoMesh.com (PID: 7948 cmdline: "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q" MD5: 62D09F076E6E0240548C2F837536A46A)

wscript.exe (PID: 3620 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

InnoMesh.com (PID: 1460 cmdline: "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q" MD5: 62D09F076E6E0240548C2F837536A46A)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F, CommandLine: schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8036, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F, ProcessId: 2736, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", ProcessId: 6296, ProcessName: wscript.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js", ProcessId: 6296, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7200, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 8000, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , ProcessId: 6776, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49771	23.197.127.21	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49765	104.21.64.1	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49756	188.114.97.3	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49759	104.21.48.1	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49744	149.154.167.99	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49768	23.197.127.21	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49762	104.21.64.1	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49753	188.114.97.3	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49750	104.21.48.1	443	TCP
2025-03-14T08:48:45.731285+0100	2028371	3	Unknown Traffic	192.168.2.5	49747	104.21.6.2	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: RbCSdRdU5F.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: RbCSdRdU5F.exe	ReversingLabs: Detection: 42%
Source: RbCSdRdU5F.exe	Virustotal: Detection: 34%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.0% probability

Source: RbCSdRdU5F.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: RbCSdRdU5F.exe

Static PE information: certificate valid

Source: RbCSdRdU5F.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_00406850 FindFirstFileW,FindClose,	0_2_00406850
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C26
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	26_2_0019A087
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	26_2_0019A1E2
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	26_2_0018E472
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	26_2_0019A570
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0015C622 FindFirstFileExW,	26_2_0015C622
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001966DC FindFirstFileW,FindNextFileW,FindClose,	26_2_001966DC
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00197333 FindFirstFileW,FindClose,	26_2_00197333
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001973D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	26_2_001973D4
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	26_2_0018D921
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	26_2_0018DC54

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\70410	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\70410\	Jump to behavior

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49771 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49765 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49756 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49759 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49744 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49768 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49762 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49753 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49750 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49747 -> 104.21.6.2:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0019D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

26_2_0019D889

Source: global traffic	DNS traffic detected: DNS query: PMuOcoRqJMPILDNx.PMuOcoRqJMPILDNx
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: skylinejo.world
Source: global traffic	DNS traffic detected: DNS query: featureccus.shop
Source: global traffic	DNS traffic detected: DNS query: mrodularmall.top
Source: global traffic	DNS traffic detected: DNS query: jowinjoinery.icu
Source: global traffic	DNS traffic detected: DNS query: legenassedk.top
Source: global traffic	DNS traffic detected: DNS query: htardwarehu.icu
Source: global traffic	DNS traffic detected: DNS query: cjlaspcorne.icu
Source: global traffic	DNS traffic detected: DNS query: bugildbett.top
Source: global traffic	DNS traffic detected: DNS query: latchclan.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com

Source: RbCSdRdU5F.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: RbCSdRdU5F.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: RbCSdRdU5F.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: RbCSdRdU5F.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: RbCSdRdU5F.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: RbCSdRdU5F.exe	String found in binary or memory: http://ocsp.sectigo.com01
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Fault.com, 00000012.00000000.1350579090.00000000007F5000.00000002.00000001.01000000.00000008.sdmp, InnoMesh.com, 0000001A.00000000.1383465549.00000000001F5000.00000002.00000001.01000000.0000000A.sdmp, InnoMesh.com, 0000001F.00000000.1498397898.00000000001F5000.00000002.00000001.01000000.0000000A.sdmp, Namely.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: RbCSdRdU5F.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InnoMesh.com.18.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Code function: 0_2_004056BB GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056BB

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0019F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

26_2_0019F7C7

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0019F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

26_2_0019F55C

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0018A635 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

26_2_0018A635

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_001B9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

26_2_001B9FD2

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript called in batch mode (surpress errors)

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00194763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

26_2_00194763

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00181B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

26_2_00181B4D

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040350A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		26_2_0018F20D

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\AmericaSubscription	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\GoldAdvantages	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\HumansMitsubishi	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\JvcHolidays	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\FutureAnna	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\ProductionEstablished	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	File created: C:\Windows\TheaterScotia	Jump to behavior

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00148017	26_2_00148017
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0013E144	26_2_0013E144
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0012E1F0	26_2_0012E1F0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0015A26E	26_2_0015A26E
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001422A2	26_2_001422A2
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001222AD	26_2_001222AD
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0013C624	26_2_0013C624
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0015E87F	26_2_0015E87F
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001AC8A4	26_2_001AC8A4
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00192A05	26_2_00192A05
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00156ADE	26_2_00156ADE
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00188BFF	26_2_00188BFF
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0013CD7A	26_2_0013CD7A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0014CE10	26_2_0014CE10
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00157159	26_2_00157159
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00129240	26_2_00129240
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001B5311	26_2_001B5311
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001296E0	26_2_001296E0
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00141704	26_2_00141704
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00141A76	26_2_00141A76
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00129B60	26_2_00129B60
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00147B8B	26_2_00147B8B
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00141D20	26_2_00141D20
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00147DBA	26_2_00147DBA
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00141FE7	26_2_00141FE7

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\70410\Fault.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: String function: 0013FD52 appears 40 times
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: String function: 00140DA0 appears 46 times

Source: RbCSdRdU5F.exe, 00000000.00000002.1337463929.0000000000B3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe. vs RbCSdRdU5F.exe
Source: RbCSdRdU5F.exe, 00000000.00000003.1334637887.0000000000B3B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe. vs RbCSdRdU5F.exe

Source: RbCSdRdU5F.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal78.expl.evad.winEXE@42/30@12/6

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_001941FA GetLastError,FormatMessageW,

26_2_001941FA

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	0_2_0040350A
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00182010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	26_2_00182010
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00181A0B AdjustTokenPrivileges,CloseHandle,	26_2_00181A0B

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Code function: 0_2_00404967 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404967

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0018DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

26_2_0018DD87

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00193A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

26_2_00193A0E

Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com

File created: C:\Users\user\AppData\Local\TechMesh Dynamics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5092:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1672:120:WilError_03

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

File created: C:\Users\user\AppData\Local\Temp\nsu33D4.tmp

Jump to behavior

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat

Source: RbCSdRdU5F.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RbCSdRdU5F.exe	ReversingLabs: Detection: 42%
Source: RbCSdRdU5F.exe	Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

File read: C:\Users\user\Desktop\RbCSdRdU5F.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RbCSdRdU5F.exe "C:\Users\user\Desktop\RbCSdRdU5F.exe"
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Panic.potx Panic.potx.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 70410
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Apple.potx
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ALIGN" Installation
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 70410\Fault.com + Contains + Faith + Trackback + Yang + Podcasts + Leaving + Newport + Searched + Accepts + Namely + Food 70410\Fault.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nsw.potx + ..\Army.potx + ..\Administrative.potx + ..\Calculations.potx + ..\Simultaneously.potx + ..\Closely.potx + ..\Nationwide.potx + ..\Ton.potx J
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\70410\Fault.com Fault.com J
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Panic.potx Panic.potx.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 70410	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Apple.potx	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ALIGN" Installation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 70410\Fault.com + Contains + Faith + Trackback + Yang + Podcasts + Leaving + Newport + Searched + Accepts + Namely + Food 70410\Fault.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nsw.potx + ..\Army.potx + ..\Administrative.potx + ..\Calculations.potx + ..\Simultaneously.potx + ..\Closely.potx + ..\Nationwide.potx + ..\Ton.potx J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\70410\Fault.com Fault.com J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & echo URL="C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\expand.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RbCSdRdU5F.exe

Static PE information: certificate valid

Source: RbCSdRdU5F.exe

Static file information: File size 1277464 > 1048576

Source: RbCSdRdU5F.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00125FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

26_2_00125FC8

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001702D8 push cs; retn 0016h		26_2_00170318
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00140DE6 push ecx; ret		26_2_00140DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\70410\Fault.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	File created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\70410\Fault.com			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	File created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Jump to behavior

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001B26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		26_2_001B26DD
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0013FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		26_2_0013FC7C

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_26-104997

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

API coverage: 3.9 %

Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com TID: 7596

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_00406850 FindFirstFileW,FindClose,	0_2_00406850
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B
Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Code function: 0_2_00405C26 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C26
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	26_2_0019A087
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	26_2_0019A1E2
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	26_2_0018E472
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0019A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	26_2_0019A570
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0015C622 FindFirstFileExW,	26_2_0015C622
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001966DC FindFirstFileW,FindNextFileW,FindClose,	26_2_001966DC
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00197333 FindFirstFileW,FindClose,	26_2_00197333
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001973D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	26_2_001973D4
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	26_2_0018D921
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_0018DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	26_2_0018DC54

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00125FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

26_2_00125FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\70410	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\70410\	Jump to behavior

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

API call chain: ExitProcess graph end node

graph_0-3500

Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0019F4FF BlockInput,

26_2_0019F4FF

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0012338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

26_2_0012338B

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00125FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

26_2_00125FC8

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00145058 mov eax, dword ptr fs:[00000030h]

26_2_00145058

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_001820AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

26_2_001820AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00152992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00152992
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00140BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00140BAF
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00140D45 SetUnhandledExceptionFilter,	26_2_00140D45
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_00140F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00140F91

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

26_2_00181B4D

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0012338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

26_2_0012338B

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0018BBED SendInput,keybd_event,

26_2_0018BBED

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0018EC6C mouse_event,

26_2_0018EC6C

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c expand Panic.potx Panic.potx.bat & Panic.potx.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\expand.exe expand Panic.potx Panic.potx.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 70410	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Apple.potx	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "ALIGN" Installation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 70410\Fault.com + Contains + Faith + Trackback + Yang + Podcasts + Leaving + Newport + Searched + Accepts + Namely + Food 70410\Fault.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nsw.potx + ..\Army.potx + ..\Administrative.potx + ..\Calculations.potx + ..\Simultaneously.potx + ..\Closely.potx + ..\Nationwide.potx + ..\Ton.potx J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\70410\Fault.com Fault.com J	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Messaging" /tr "wscript //B 'C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js'" /sc minute /mo 5 /F	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com" "C:\Users\user\AppData\Local\TechMesh Dynamics\Q"

Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & echo url="c:\users\user\appdata\local\techmesh dynamics\innomesh.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & exit
Source: C:\Users\user\AppData\Local\Temp\70410\Fault.com	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & echo url="c:\users\user\appdata\local\techmesh dynamics\innomesh.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\innomesh.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_001814AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

26_2_001814AE

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00181FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

26_2_00181FB0

Source: Fault.com, 00000012.00000000.1350510892.00000000007E3000.00000002.00000001.01000000.00000008.sdmp, Fault.com, 00000012.00000003.1358736969.0000000003F1D000.00000004.00000800.00020000.00000000.sdmp, InnoMesh.com, 0000001A.00000002.1393127334.00000000001E3000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: InnoMesh.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_00140A08 cpuid

26_2_00140A08

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0017E5F4 GetLocalTime,

26_2_0017E5F4

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0017E652 GetUserNameW,

26_2_0017E652

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com

Code function: 26_2_0015BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

26_2_0015BCD2

Source: C:\Users\user\Desktop\RbCSdRdU5F.exe

Code function: 0_2_0040350A EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040350A

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: InnoMesh.com	Binary or memory string: WIN_81
Source: InnoMesh.com	Binary or memory string: WIN_XP
Source: InnoMesh.com.18.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: InnoMesh.com	Binary or memory string: WIN_XPe
Source: InnoMesh.com	Binary or memory string: WIN_VISTA
Source: InnoMesh.com	Binary or memory string: WIN_7
Source: InnoMesh.com	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001A2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		26_2_001A2263
Source: C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	Code function: 26_2_001A1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		26_2_001A1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	12 Process Injection	111 Masquerading	LSA Secrets	12 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	2 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RbCSdRdU5F.exe	42%	ReversingLabs	Win32.Exploit.Generic
RbCSdRdU5F.exe	35%	Virustotal		Browse
RbCSdRdU5F.exe	100%	Avira	TR/AVI.Agent.lfdhj

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\70410\Fault.com	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com01	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
skylinejo.world	104.21.6.2	true	false	unknown
steamcommunity.com	23.197.127.21	true	false	high
jowinjoinery.icu	188.114.97.3	true	false	high
t.me	149.154.167.99	true	false	high
legenassedk.top	188.114.97.3	true	false	high
htardwarehu.icu	104.21.48.1	true	false	high
bugildbett.top	104.21.64.1	true	false	high
mrodularmall.top	104.21.48.1	true	false	high
cjlaspcorne.icu	104.21.64.1	true	false	high
PMuOcoRqJMPILDNx.PMuOcoRqJMPILDNx	unknown	unknown	true	unknown
latchclan.shop	unknown	unknown	false	high
featureccus.shop	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	RbCSdRdU5F.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	RbCSdRdU5F.exe	false		high
http://ocsp.sectigo.com01	RbCSdRdU5F.exe	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	RbCSdRdU5F.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	RbCSdRdU5F.exe	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	RbCSdRdU5F.exe	false		high
http://ocsp.sectigo.com0	RbCSdRdU5F.exe	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	RbCSdRdU5F.exe	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	RbCSdRdU5F.exe	false		high
http://www.autoitscript.com/autoit3/X	Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Fault.com, 00000012.00000000.1350579090.00000000007F5000.00000002.00000001.01000000.00000008.sdmp, InnoMesh.com, 0000001A.00000000.1383465549.00000000001F5000.00000002.00000001.01000000.0000000A.sdmp, InnoMesh.com, 0000001F.00000000.1498397898.00000000001F5000.00000002.00000001.01000000.0000000A.sdmp, Namely.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	RbCSdRdU5F.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	RbCSdRdU5F.exe	false		high
https://www.autoitscript.com/autoit3/	Fault.com, 00000012.00000003.1358487438.0000000003E31000.00000004.00000800.00020000.00000000.sdmp, Food.14.dr, Fault.com.6.dr, InnoMesh.com.18.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	RbCSdRdU5F.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	htardwarehu.icu	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	jowinjoinery.icu	European Union	13335	CLOUDFLARENETUS	false
23.197.127.21	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
104.21.64.1	bugildbett.top	United States	13335	CLOUDFLARENETUS	false
104.21.6.2	skylinejo.world	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1638139
Start date and time:	2025-03-14 08:48:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RbCSdRdU5F.exe renamed because original name is a hash value
Original Sample Name:	dba844b00d59c245382b87ce7441a86c23df76cd517c5a291e91e76ecb8b7873.exe
Detection:	MAL
Classification:	mal78.expl.evad.winEXE@42/30@12/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 80 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ev2-ring.msedge.net, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, g.bing.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:49:02	Task Scheduler	Run new task: Messaging path: wscript s>//B "C:\Users\user\AppData\Local\TechMesh Dynamics\InnoMesh.js"
08:49:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoMesh.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	345623.bat	Get hash	malicious	DBatLoader, FormBook	Browse	www.shlomi.app/9rzh/
	ySUB97Jq80.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.shlomi.app/9rzh/
	hQaXUS5gt0.exe	Get hash	malicious	FormBook	Browse	www.newanthoperso.shop/3nis/
	6nA8ZygZLP.exe	Get hash	malicious	FormBook	Browse	www.rbopisalive.cyou/2dxw/
	UhuGtHUgHf.exe	Get hash	malicious	FormBook	Browse	www.enoughmoney.online/z9gb/
	Bill_of_Lading_20250307_pdf.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	Stormwater Works Drawings Spec.js	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	Shipment Delivery No DE0093002-PDF.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	Remittance_CT022024.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/	Get hash	malicious	HTMLPhisher	Browse	microsoft-sharepoint4543464633.pages.dev/index-2jc93/
188.114.97.3	http://sg-adh7.vv.885210.xyz/	Get hash	malicious	Unknown	Browse	sg-adh7.vv.885210.xyz/favicon.ico
	http://caixadirectasecdigital.com/	Get hash	malicious	HTMLPhisher	Browse	caixadirectasecdigital.com/favicon.ico
	PO NO 28950.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/
	RFQ- Italy.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xploitation.net/sqjz/
	Enquiry Quote - 21834-01.exe	Get hash	malicious	FormBook	Browse	www.joeyvv.xyz/b80n/
	DcbI6OM1wO.exe	Get hash	malicious	Lokibot, PureLog Stealer, zgRAT	Browse	ddrtot.shop/New/PWS/fre.php
	kVPzMgJglW.exe	Get hash	malicious	FormBook	Browse	www.timeinsardinia.info/j4nd/
	tnZI8EzSx3.exe	Get hash	malicious	FormBook	Browse	www.braposaldesk.cyou/3it7/
	zzSk99EqY0.exe	Get hash	malicious	FormBook	Browse	www.braposaldesk.cyou/3it7/
	hh01FRs81x.exe	Get hash	malicious	FormBook	Browse	www.serenityos.dev/dntg/?R4lxS2-P=Xi77pNpzRwduTXf13DwoRl9ks24bE/OoZO8jI9GlbI12YargANeHXOwJPk3kluRPu8INtGeEgdhJoy+Tym0P0ZbjUAApu4gNis/FV3kbZJq8JK1mGA==&LL=4FHLH

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	Portals.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Portals.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://auth.microsites.m-atelier.cz/redir?url=https://telegra.ph/Charlotte-Reeves-03-13&data=05%7C02%7Cteat@test.com%7Cf85134ec55e24fa0741708dd623d50ea%7C22def1f7e945453d836bda7282c42443%7C0%7C0%7C638774737677482831%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ==%7C0%7C%7C%7C&sdata=AFWlQKGCYsB3szoYr99UdtJsHEuv5b0KPmvHih+dvhk=&reserved=0	Get hash	malicious	Unknown	Browse	149.154.167.99
	ngbtiladkrthgad.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CheatInjector.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	SimpleLoader v2.1.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	http://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php	Get hash	malicious	Unknown	Browse	50.6.3.255
	https://khr.lfp.mybluehost.me/intesasanpaolo/web/login.php/	Get hash	malicious	Unknown	Browse	50.6.3.255
	Launcher.exe	Get hash	malicious	LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	149.154.167.99
jowinjoinery.icu	setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	FusionLoader v2.1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	kmtsefjtjha.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
legenassedk.top	setup.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	FusionLoader v2.1.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
	nvtoaldlrg.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
	L0erlgyZ6f.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	188.114.97.3
	ModMenu.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.97.3
steamcommunity.com	setup.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RbCSdRdU5F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

Windows Analysis Report
RbCSdRdU5F.exe