Edit tour

Windows Analysis Report
finebi.exe

Overview

General Information

Sample name:	finebi.exe
Analysis ID:	1639429
MD5:	ef0821209a3166e8142f5d170708b114
SHA1:	653b95b24480dd60982e95e19f15c736321cbade
SHA256:	47abbb7ad1ca5dea21674694dbe2dd59ebd4be8ce2fc15554c68574614f3d136
Tags:	CobaltStrikeexeuser-kafan_shengui
Infos:

Detection

Score:	68
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

Contains functionality to detect sleep reduction / modifications

Joe Sandbox ML detected suspicious sample

Performs DNS queries to domains with low reputation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found decision node followed by non-executed suspicious APIs

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Communication To Uncommon Destination Ports

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

finebi.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\finebi.exe" MD5: EF0821209A3166E8142F5D170708B114)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 188.114.97.3, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\finebi.exe, Initiated: true, ProcessId: 7480, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49720

Suricata Signatures

ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-15T15:56:06.960162+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:56:39.041066+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:56:51.417022+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:56:59.556492+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:57:07.481185+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:57:21.541100+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:57:31.902127+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:57:46.135115+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:57:57.212918+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:58:10.009853+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:58:20.525464+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:58:35.664234+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:58:42.822479+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:58:54.307172+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:59:05.715244+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP
2025-03-15T15:59:13.246006+0100	2033009	1	Malware Command and Control Activity Detected	188.114.97.3	8080	192.168.2.5	49722	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0ud	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js.	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsnsock	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0u	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsD	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0uL	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsward-	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js-	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06F	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz/jquery-3.3.1.min.js	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsUm	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0ut	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0us	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0u4	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsward	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jst	Avira URL Cloud: Label: malware
Source: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06d	Avira URL Cloud: Label: malware

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.9% probability

Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA9DC0 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,	0_2_00007FF75DAA9DC0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA1220 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,clock,clock,	0_2_00007FF75DAA1220
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB56A0 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,	0_2_00007FF75DAB56A0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA1390 CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	0_2_00007FF75DAA1390

Source: finebi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA95F00 malloc,memset,strncmp,GetCurrentDirectoryA,strncat_s,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00007FF75DA95F00
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA96460 malloc,FindFirstFileA,free,malloc,malloc,free,free,FindNextFileA,FindClose,		0_2_00007FF75DA96460

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2033009 - Severity 1 - ET MALWARE Cobalt Strike Malleable C2 JQuery Custom Profile Response : 188.114.97.3:8080 -> 192.168.2.5:49722

Performs DNS queries to domains with low reputation

Source:

DNS query: apiapi.mmkinskfn.xyz

Source: global traffic

TCP traffic: 192.168.2.5:49720 -> 188.114.97.3:8080

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9D0F0 memset,HttpOpenRequestA,HttpSendRequestA,InternetCloseHandle,InternetQueryDataAvailable,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF75DA9D0F0

Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jquery-3.3.1.min.js HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Host: apiapi.mmkinskfn.xyzAccept-Encoding: gzip, deflateCookie: __cfduid=MroQn6eH6gh3DMGdAAaQOw_eDXCDoxXqU5mxLkCNbXnYUmtQqBjn_1-P3eMn0pAgeN0d4V_vz6JQpDObSHVT2RHv1WGJ-UyuC_ya2xfL3EW8tooPVj05kSsMai3TWxT4N0E6-_eomQUt0NDt-shrOaUCDWjkqd1wsmC_OVcZKFwUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: apiapi.mmkinskfn.xyz

Source: finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js
Source: finebi.exe, 00000000.00000003.2297776973.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1800801093.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1515959738.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2187493629.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1640034764.000001D8B6815000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1723643625.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2045132812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js-
Source: finebi.exe, 00000000.00000002.3098831995.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.3058585670.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js.
Source: finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0u
Source: finebi.exe, 00000000.00000003.2297776973.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2426098486.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0u4
Source: finebi.exe, 00000000.00000003.1800801093.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1515959738.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1640034764.000001D8B6815000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1723643625.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2045132812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0uL
Source: finebi.exe, 00000000.00000003.2297776973.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1800801093.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2682215947.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2868908810.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2187493629.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2426098486.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2045132812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2983134812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0ud
Source: finebi.exe, 00000000.00000003.2682215947.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2187493629.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2426098486.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2045132812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0us
Source: finebi.exe, 00000000.00000003.2868908810.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2983134812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js0ut
Source: finebi.exe, 00000000.00000003.2682215947.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2868908810.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2983134812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06
Source: finebi.exe, 00000000.00000003.2187493629.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2045132812.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06F
Source: finebi.exe, 00000000.00000003.2682215947.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.js11b87bd06d
Source: finebi.exe, 00000000.00000003.1800801093.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1640034764.000001D8B6815000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1723643625.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsD
Source: finebi.exe, 00000000.00000002.3098831995.000001D8B67AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsUm
Source: finebi.exe, 00000000.00000003.1515959738.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsnsock
Source: finebi.exe, 00000000.00000003.2297776973.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2187493629.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jst
Source: finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1941361657.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1639877754.000001D8B6813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsward
Source: finebi.exe, 00000000.00000003.2682215947.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2868908810.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756261866.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2531253955.000001D8B6816000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://apiapi.mmkinskfn.xyz:8080/jquery-3.3.1.min.jsward-

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9F110 GetStartupInfoA,GetCurrentDirectoryW,GetCurrentDirectoryW,CreateProcessWithLogonW,GetLastError,

0_2_00007FF75DA9F110

Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA95890	0_2_00007FF75DA95890
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA95500	0_2_00007FF75DA95500
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB66F0	0_2_00007FF75DAB66F0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA98EE0	0_2_00007FF75DA98EE0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA9E5C0	0_2_00007FF75DA9E5C0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA97E10	0_2_00007FF75DA97E10
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA40A0	0_2_00007FF75DAA40A0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA94720	0_2_00007FF75DA94720
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA3250	0_2_00007FF75DAA3250
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA3A90	0_2_00007FF75DAA3A90
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA34C0	0_2_00007FF75DAA34C0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB4CA0	0_2_00007FF75DAB4CA0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA94CF0	0_2_00007FF75DA94CF0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAA93F0	0_2_00007FF75DAA93F0

Source: C:\Users\user\Desktop\finebi.exe

Code function: String function: 00007FF75DAA8CB0 appears 243 times

Source: finebi.exe

Binary or memory string: OriginalFilename vs finebi.exe

Source: classification engine

Classification label: mal68.troj.evad.winEXE@2/0@1/1

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DAA06B0 LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

0_2_00007FF75DAA06B0

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9EDD0 memset,GetCurrentProcess,CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,OpenProcessToken,CloseHandle,ProcessIdToSessionId,CloseHandle,Process32NextW,CloseHandle,CloseHandle,

0_2_00007FF75DA9EDD0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03

Source: finebi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\finebi.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\finebi.exe "C:\Users\user\Desktop\finebi.exe"
Source: C:\Users\user\Desktop\finebi.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\finebi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\finebi.exe	Section loaded: winnsi.dll	Jump to behavior

Source: C:\Users\user\Desktop\finebi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: finebi.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: finebi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: finebi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: finebi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: finebi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: finebi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: finebi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: finebi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: finebi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA91000 malloc,LoadLibraryA,FreeLibrary,GetProcAddress,GetModuleHandleA,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,memcpy,memset,VirtualFree,free,

0_2_00007FF75DA91000

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9A880

0_2_00007FF75DA9A880

Source: C:\Users\user\Desktop\finebi.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-14214

Source: C:\Users\user\Desktop\finebi.exe

API coverage: 7.0 %

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9A880

0_2_00007FF75DA9A880

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA95F00 malloc,memset,strncmp,GetCurrentDirectoryA,strncat_s,FindFirstFileA,GetLastError,free,free,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,FindNextFileA,FindClose,		0_2_00007FF75DA95F00
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DA96460 malloc,FindFirstFileA,free,malloc,malloc,free,free,FindNextFileA,FindClose,		0_2_00007FF75DA96460

Source: finebi.exe, 00000000.00000003.2297776973.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1723643625.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1640034764.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.3058470832.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2187493629.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2682215947.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2983134812.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1801147348.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2425982853.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.2756372527.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp, finebi.exe, 00000000.00000003.1515959738.000001D8B6832000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: finebi.exe, 00000000.00000002.3098831995.000001D8B67AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW d

Source: C:\Users\user\Desktop\finebi.exe

API call chain: ExitProcess graph end node

graph_0-13566

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DAB9158 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF75DAB9158

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA91000 malloc,LoadLibraryA,FreeLibrary,GetProcAddress,GetModuleHandleA,VirtualAlloc,GetModuleHandleA,LoadLibraryA,GetProcAddress,memcpy,memset,VirtualFree,free,

0_2_00007FF75DA91000

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA93850 DeleteProcThreadAttributeList,GetProcessHeap,HeapFree,

0_2_00007FF75DA93850

Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB9158 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF75DAB9158
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB84D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF75DAB84D0
Source: C:\Users\user\Desktop\finebi.exe	Code function: 0_2_00007FF75DAB933C SetUnhandledExceptionFilter,	0_2_00007FF75DAB933C

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9F600 LogonUserA,ImpersonateLoggedOnUser,GetLastError,GetLastError,

0_2_00007FF75DA9F600

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DAA02F0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF75DAA02F0

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA96D80 memcpy,CreateNamedPipeA,

0_2_00007FF75DA96D80

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DAB901C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF75DAB901C

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA9DBA0 GetUserNameA,GetComputerNameA,exit,gethostname,gethostbyname,GetModuleFileNameA,strrchr,GetProcAddress,GetModuleHandleA,GetProcAddress,

0_2_00007FF75DA9DBA0

Source: C:\Users\user\Desktop\finebi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\finebi.exe

Code function: 0_2_00007FF75DA97C80 socket,htons,ioctlsocket,bind,listen,closesocket,

0_2_00007FF75DA97C80

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	21 Access Token Manipulation	21 Access Token Manipulation	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	2 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
finebi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report finebi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
finebi.exe