Edit tour

Windows Analysis Report
RFQ 306 & 307.exe

Overview

General Information

Sample name:	RFQ 306 & 307.exe
Analysis ID:	1640566
MD5:	98f5e0e1ea843b54bb5d5b71a916b130
SHA1:	60a5239cb8f370c3e34e87872fc82c66fe6b893e
SHA256:	2d3083544d87f65cb65db78b9050d6dbf69412f94c49ee82cf59dd889f19ece8
Tags:	exeuser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

RFQ 306 & 307.exe (PID: 716 cmdline: "C:\Users\user\Desktop\RFQ 306 & 307.exe" MD5: 98F5E0E1EA843B54BB5D5B71A916B130)

RFQ 306 & 307.exe (PID: 5560 cmdline: "C:\Users\user\Desktop\RFQ 306 & 307.exe" MD5: 98F5E0E1EA843B54BB5D5B71A916B130)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM/sendMessage?chat_id=5521168189", "Token": "8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM", "Chat_id": "5521168189", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1492f:$a1: get_encryptedPassword 0x14c1b:$a2: get_encryptedUsername 0x1473b:$a3: get_timePasswordChanged 0x14836:$a4: get_passwordField 0x14945:$a5: set_encryptedPassword 0x15f76:$a7: get_logins 0x15ed9:$a10: KeyLoggerEventArgs 0x15b44:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19898:$x1: $%SMTPDV$ 0x1827c:$x2: $#TheHashHere%& 0x19840:$x3: %FTPDV$ 0x1821c:$x4: $%TelegramDv$ 0x15b44:$x5: KeyLoggerEventArgs 0x15ed9:$x5: KeyLoggerEventArgs 0x19864:$m2: Clipboard Logs ID 0x19aa2:$m2: Screenshot Logs ID 0x19bb2:$m2: keystroke Logs ID 0x19e8c:$m3: SnakePW 0x19a7a:$m4: \SnakeKeylogger\
00000001.00000002.3420124355.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x82c8f:$a1: get_encryptedPassword 0xa36af:$a1: get_encryptedPassword 0xc3ecf:$a1: get_encryptedPassword 0x82f7b:$a2: get_encryptedUsername 0xa399b:$a2: get_encryptedUsername 0xc41bb:$a2: get_encryptedUsername 0x82a9b:$a3: get_timePasswordChanged 0xa34bb:$a3: get_timePasswordChanged 0xc3cdb:$a3: get_timePasswordChanged 0x82b96:$a4: get_passwordField 0xa35b6:$a4: get_passwordField 0xc3dd6:$a4: get_passwordField 0x82ca5:$a5: set_encryptedPassword 0xa36c5:$a5: set_encryptedPassword 0xc3ee5:$a5: set_encryptedPassword 0x842d6:$a7: get_logins 0xa4cf6:$a7: get_logins 0xc5516:$a7: get_logins 0x84239:$a10: KeyLoggerEventArgs 0xa4c59:$a10: KeyLoggerEventArgs 0xc5479:$a10: KeyLoggerEventArgs
00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x87bf8:$x1: $%SMTPDV$ 0xa8618:$x1: $%SMTPDV$ 0xc8e38:$x1: $%SMTPDV$ 0x865dc:$x2: $#TheHashHere%& 0xa6ffc:$x2: $#TheHashHere%& 0xc781c:$x2: $#TheHashHere%& 0x87ba0:$x3: %FTPDV$ 0xa85c0:$x3: %FTPDV$ 0xc8de0:$x3: %FTPDV$ 0x8657c:$x4: $%TelegramDv$ 0xa6f9c:$x4: $%TelegramDv$ 0xc77bc:$x4: $%TelegramDv$ 0x83ea4:$x5: KeyLoggerEventArgs 0x84239:$x5: KeyLoggerEventArgs 0xa48c4:$x5: KeyLoggerEventArgs 0xa4c59:$x5: KeyLoggerEventArgs 0xc50e4:$x5: KeyLoggerEventArgs 0xc5479:$x5: KeyLoggerEventArgs 0x87bc4:$m2: Clipboard Logs ID 0x87e02:$m2: Screenshot Logs ID 0x87f12:$m2: keystroke Logs ID
00000001.00000002.3420124355.0000000002881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RFQ 306 & 307.exe PID: 716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ 306 & 307.exe PID: 716	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RFQ 306 & 307.exe PID: 716	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d219:$a1: get_encryptedPassword 0x2d4fb:$a2: get_encryptedUsername 0x2d02f:$a3: get_timePasswordChanged 0x2d12a:$a4: get_passwordField 0x2d22f:$a5: set_encryptedPassword 0x2f706:$a7: get_logins 0x2f669:$a10: KeyLoggerEventArgs 0x2f2d4:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RFQ 306 & 307.exe PID: 716	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2f2d4:$x5: KeyLoggerEventArgs 0x2f669:$x5: KeyLoggerEventArgs 0x2ff70:$x5: KeyLoggerEventArgs 0x302d1:$x5: KeyLoggerEventArgs 0x31894:$m2: Clipboard Logs ID 0x3199a:$m2: Screenshot Logs ID 0x319f0:$m2: keystroke Logs ID 0x31b25:$m3: SnakePW 0x31986:$m4: \SnakeKeylogger\
Process Memory Space: RFQ 306 & 307.exe PID: 5560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RFQ 306 & 307.exe PID: 5560	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RFQ 306 & 307.exe PID: 5560	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1799:$a1: get_encryptedPassword 0x1a7b:$a2: get_encryptedUsername 0x15af:$a3: get_timePasswordChanged 0x16aa:$a4: get_passwordField 0x17af:$a5: set_encryptedPassword 0x3c86:$a7: get_logins 0x3be9:$a10: KeyLoggerEventArgs 0x3854:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RFQ 306 & 307.exe PID: 5560	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3854:$x5: KeyLoggerEventArgs 0x3be9:$x5: KeyLoggerEventArgs 0x44f0:$x5: KeyLoggerEventArgs 0x4851:$x5: KeyLoggerEventArgs 0x5e14:$m2: Clipboard Logs ID 0x5f1a:$m2: Screenshot Logs ID 0x5f70:$m2: keystroke Logs ID 0x60a5:$m3: SnakePW 0x5f06:$m4: \SnakeKeylogger\
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RFQ 306 & 307.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RFQ 306 & 307.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RFQ 306 & 307.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b2f:$a1: get_encryptedPassword 0x14e1b:$a2: get_encryptedUsername 0x1493b:$a3: get_timePasswordChanged 0x14a36:$a4: get_passwordField 0x14b45:$a5: set_encryptedPassword 0x16176:$a7: get_logins 0x160d9:$a10: KeyLoggerEventArgs 0x15d44:$a11: KeyLoggerEventArgsEventHandler
1.2.RFQ 306 & 307.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c44e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b680:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bab3:$a4: \Orbitum\User Data\Default\Login Data 0x1caf2:$a5: \Kometa\User Data\Default\Login Data
1.2.RFQ 306 & 307.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156f3:$s1: UnHook 0x156fa:$s2: SetHook 0x15702:$s3: CallNextHook 0x1570f:$s4: _hook
1.2.RFQ 306 & 307.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a98:$x1: $%SMTPDV$ 0x1847c:$x2: $#TheHashHere%& 0x19a40:$x3: %FTPDV$ 0x1841c:$x4: $%TelegramDv$ 0x15d44:$x5: KeyLoggerEventArgs 0x160d9:$x5: KeyLoggerEventArgs 0x19a64:$m2: Clipboard Logs ID 0x19ca2:$m2: Screenshot Logs ID 0x19db2:$m2: keystroke Logs ID 0x1a08c:$m3: SnakePW 0x19c7a:$m4: \SnakeKeylogger\
0.2.RFQ 306 & 307.exe.3557160.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 306 & 307.exe.3557160.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ 306 & 307.exe.3557160.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d2f:$a1: get_encryptedPassword 0x1301b:$a2: get_encryptedUsername 0x12b3b:$a3: get_timePasswordChanged 0x12c36:$a4: get_passwordField 0x12d45:$a5: set_encryptedPassword 0x14376:$a7: get_logins 0x142d9:$a10: KeyLoggerEventArgs 0x13f44:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 306 & 307.exe.3557160.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a64e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19880:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cb3:$a4: \Orbitum\User Data\Default\Login Data 0x1acf2:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ 306 & 307.exe.3557160.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x138f3:$s1: UnHook 0x138fa:$s2: SetHook 0x13902:$s3: CallNextHook 0x1390f:$s4: _hook
0.2.RFQ 306 & 307.exe.3557160.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c98:$x1: $%SMTPDV$ 0x1667c:$x2: $#TheHashHere%& 0x17c40:$x3: %FTPDV$ 0x1661c:$x4: $%TelegramDv$ 0x13f44:$x5: KeyLoggerEventArgs 0x142d9:$x5: KeyLoggerEventArgs 0x17c64:$m2: Clipboard Logs ID 0x17ea2:$m2: Screenshot Logs ID 0x17fb2:$m2: keystroke Logs ID 0x1828c:$m3: SnakePW 0x17e7a:$m4: \SnakeKeylogger\
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12d2f:$a1: get_encryptedPassword 0x1301b:$a2: get_encryptedUsername 0x12b3b:$a3: get_timePasswordChanged 0x12c36:$a4: get_passwordField 0x12d45:$a5: set_encryptedPassword 0x14376:$a7: get_logins 0x142d9:$a10: KeyLoggerEventArgs 0x13f44:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a64e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19880:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cb3:$a4: \Orbitum\User Data\Default\Login Data 0x1acf2:$a5: \Kometa\User Data\Default\Login Data
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x138f3:$s1: UnHook 0x138fa:$s2: SetHook 0x13902:$s3: CallNextHook 0x1390f:$s4: _hook
0.2.RFQ 306 & 307.exe.3577b80.1.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c98:$x1: $%SMTPDV$ 0x1667c:$x2: $#TheHashHere%& 0x17c40:$x3: %FTPDV$ 0x1661c:$x4: $%TelegramDv$ 0x13f44:$x5: KeyLoggerEventArgs 0x142d9:$x5: KeyLoggerEventArgs 0x17c64:$m2: Clipboard Logs ID 0x17ea2:$m2: Screenshot Logs ID 0x17fb2:$m2: keystroke Logs ID 0x1828c:$m3: SnakePW 0x17e7a:$m4: \SnakeKeylogger\
0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b2f:$a1: get_encryptedPassword 0x3534f:$a1: get_encryptedPassword 0x14e1b:$a2: get_encryptedUsername 0x3563b:$a2: get_encryptedUsername 0x1493b:$a3: get_timePasswordChanged 0x3515b:$a3: get_timePasswordChanged 0x14a36:$a4: get_passwordField 0x35256:$a4: get_passwordField 0x14b45:$a5: set_encryptedPassword 0x35365:$a5: set_encryptedPassword 0x16176:$a7: get_logins 0x36996:$a7: get_logins 0x160d9:$a10: KeyLoggerEventArgs 0x368f9:$a10: KeyLoggerEventArgs 0x15d44:$a11: KeyLoggerEventArgsEventHandler 0x36564:$a11: KeyLoggerEventArgsEventHandler
0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156f3:$s1: UnHook 0x35f13:$s1: UnHook 0x156fa:$s2: SetHook 0x35f1a:$s2: SetHook 0x15702:$s3: CallNextHook 0x35f22:$s3: CallNextHook 0x1570f:$s4: _hook 0x35f2f:$s4: _hook
0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a98:$x1: $%SMTPDV$ 0x3a2b8:$x1: $%SMTPDV$ 0x1847c:$x2: $#TheHashHere%& 0x38c9c:$x2: $#TheHashHere%& 0x19a40:$x3: %FTPDV$ 0x3a260:$x3: %FTPDV$ 0x1841c:$x4: $%TelegramDv$ 0x38c3c:$x4: $%TelegramDv$ 0x15d44:$x5: KeyLoggerEventArgs 0x160d9:$x5: KeyLoggerEventArgs 0x36564:$x5: KeyLoggerEventArgs 0x368f9:$x5: KeyLoggerEventArgs 0x19a64:$m2: Clipboard Logs ID 0x19ca2:$m2: Screenshot Logs ID 0x19db2:$m2: keystroke Logs ID 0x3a284:$m2: Clipboard Logs ID 0x3a4c2:$m2: Screenshot Logs ID 0x3a5d2:$m2: keystroke Logs ID 0x1a08c:$m3: SnakePW 0x3a8ac:$m3: SnakePW 0x19c7a:$m4: \SnakeKeylogger\
0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14b2f:$a1: get_encryptedPassword 0x3554f:$a1: get_encryptedPassword 0x55d6f:$a1: get_encryptedPassword 0x14e1b:$a2: get_encryptedUsername 0x3583b:$a2: get_encryptedUsername 0x5605b:$a2: get_encryptedUsername 0x1493b:$a3: get_timePasswordChanged 0x3535b:$a3: get_timePasswordChanged 0x55b7b:$a3: get_timePasswordChanged 0x14a36:$a4: get_passwordField 0x35456:$a4: get_passwordField 0x55c76:$a4: get_passwordField 0x14b45:$a5: set_encryptedPassword 0x35565:$a5: set_encryptedPassword 0x55d85:$a5: set_encryptedPassword 0x16176:$a7: get_logins 0x36b96:$a7: get_logins 0x573b6:$a7: get_logins 0x160d9:$a10: KeyLoggerEventArgs 0x36af9:$a10: KeyLoggerEventArgs 0x57319:$a10: KeyLoggerEventArgs
0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x156f3:$s1: UnHook 0x36113:$s1: UnHook 0x56933:$s1: UnHook 0x156fa:$s2: SetHook 0x3611a:$s2: SetHook 0x5693a:$s2: SetHook 0x15702:$s3: CallNextHook 0x36122:$s3: CallNextHook 0x56942:$s3: CallNextHook 0x1570f:$s4: _hook 0x3612f:$s4: _hook 0x5694f:$s4: _hook
0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a98:$x1: $%SMTPDV$ 0x3a4b8:$x1: $%SMTPDV$ 0x5acd8:$x1: $%SMTPDV$ 0x1847c:$x2: $#TheHashHere%& 0x38e9c:$x2: $#TheHashHere%& 0x596bc:$x2: $#TheHashHere%& 0x19a40:$x3: %FTPDV$ 0x3a460:$x3: %FTPDV$ 0x5ac80:$x3: %FTPDV$ 0x1841c:$x4: $%TelegramDv$ 0x38e3c:$x4: $%TelegramDv$ 0x5965c:$x4: $%TelegramDv$ 0x15d44:$x5: KeyLoggerEventArgs 0x160d9:$x5: KeyLoggerEventArgs 0x36764:$x5: KeyLoggerEventArgs 0x36af9:$x5: KeyLoggerEventArgs 0x56f84:$x5: KeyLoggerEventArgs 0x57319:$x5: KeyLoggerEventArgs 0x19a64:$m2: Clipboard Logs ID 0x19ca2:$m2: Screenshot Logs ID 0x19db2:$m2: keystroke Logs ID
Click to see the 23 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:03:39.350304+0100	2803305	3	Unknown Traffic	192.168.2.9	49685	104.21.48.1	443	TCP
2025-03-17T13:03:44.262150+0100	2803305	3	Unknown Traffic	192.168.2.9	49693	104.21.48.1	443	TCP
2025-03-17T13:03:45.454973+0100	2803305	3	Unknown Traffic	192.168.2.9	49695	104.21.48.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:03:37.476831+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49683	158.101.44.242	80	TCP
2025-03-17T13:03:38.773740+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49683	158.101.44.242	80	TCP
2025-03-17T13:03:39.980568+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49686	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM/sendMessage?chat_id=5521168189", "Token": "8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM", "Chat_id": "5521168189", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: RFQ 306 & 307.exe

ReversingLabs: Detection: 36%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor:
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 5521168189
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor:
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 5521168189
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor:
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 8052404957:AAEV5F264213Kb-8sgs9T2xYdxlZT-kESiM
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack	String decryptor: 5521168189

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: RFQ 306 & 307.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: RFQ 306 & 307.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: xoyT.pdb source: RFQ 306 & 307.exe
Source:	Binary string: xoyT.pdbSHA256\ source: RFQ 306 & 307.exe

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 00ACF1F6h	1_2_00ACF007
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 00ACFB80h	1_2_00ACF007
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	1_2_00ACE528
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06501A38h	1_2_06501620
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06501011h	1_2_06500D60
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 065002F1h	1_2_06500040
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06501471h	1_2_065011C0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650C8F1h	1_2_0650C648
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650F8B9h	1_2_0650F610
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06501A38h	1_2_06501610
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650D1A1h	1_2_0650CEF8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650DA51h	1_2_0650D7A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650DEA9h	1_2_0650DC00
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650B791h	1_2_0650B4E8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650E759h	1_2_0650E4B0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06500751h	1_2_065004A0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650F009h	1_2_0650ED60
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650C041h	1_2_0650BD98
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650FD11h	1_2_0650FA68
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650CD49h	1_2_0650CAA0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650D5F9h	1_2_0650D350
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650E301h	1_2_0650E058
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650BBE9h	1_2_0650B940
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06501A38h	1_2_06501966
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06500BB1h	1_2_06500900
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650EBB1h	1_2_0650E908
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650C499h	1_2_0650C1F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 0650F461h	1_2_0650F1B8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06538945h	1_2_06538608
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06535D19h	1_2_06535A70
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 065358C1h	1_2_06535618
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06536171h	1_2_06535EC8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06536A21h	1_2_06536778
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 065365C9h	1_2_06536320
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06536E79h	1_2_06536BD0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	1_2_065333B8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	1_2_065333A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 065372FAh	1_2_06537050
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 065302E9h	1_2_06530040
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06530B99h	1_2_065308F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06530741h	1_2_06530498
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06537751h	1_2_065374A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06538001h	1_2_06537D58
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06530FF1h	1_2_06530D48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06537BA9h	1_2_06537900
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06535441h	1_2_06535198
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 4x nop then jmp 06538459h	1_2_065381B0

Source: global traffic

TCP traffic: 192.168.2.9:63002 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49686 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49683 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49695 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49685 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49693 -> 104.21.48.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002947000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002938000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.000000000298A000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002947000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A11000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/X
Source: RFQ 306 & 307.exe, 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.orgX
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.000000000295F000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.000000000298A000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002947000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: RFQ 306 & 307.exe, 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002947000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002947000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.000000000298A000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A31000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029E8000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.00000000029DA000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189X

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: RFQ 306 & 307.exe

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_00B1D6FC	0_2_00B1D6FC
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_04A77C68	0_2_04A77C68
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_04A70120	0_2_04A70120
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_04A70130	0_2_04A70130
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_04A77C48	0_2_04A77C48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_067472D0	0_2_067472D0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674A7FF	0_2_0674A7FF
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_067472C3	0_2_067472C3
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674A3D8	0_2_0674A3D8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_06749FA0	0_2_06749FA0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674AC48	0_2_0674AC48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674A810	0_2_0674A810
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674C938	0_2_0674C938
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_06780040	0_2_06780040
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_06780007	0_2_06780007
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACF007	1_2_00ACF007
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00AC6108	1_2_00AC6108
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACB328	1_2_00ACB328
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACC470	1_2_00ACC470
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00AC6730	1_2_00AC6730
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACC751	1_2_00ACC751
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00AC9858	1_2_00AC9858
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00AC4AD9	1_2_00AC4AD9
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACCA31	1_2_00ACCA31
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACBBD3	1_2_00ACBBD3
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACBEB0	1_2_00ACBEB0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACB4F3	1_2_00ACB4F3
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACE528	1_2_00ACE528
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00ACE517	1_2_00ACE517
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_00AC3570	1_2_00AC3570
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06508460	1_2_06508460
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06500D60	1_2_06500D60
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06507B70	1_2_06507B70
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06500040	1_2_06500040
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06503870	1_2_06503870
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065011C0	1_2_065011C0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650C648	1_2_0650C648
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650F610	1_2_0650F610
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650F600	1_2_0650F600
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650C638	1_2_0650C638
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650CEF8	1_2_0650CEF8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650CEEA	1_2_0650CEEA
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650D798	1_2_0650D798
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650D7A8	1_2_0650D7A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650DC00	1_2_0650DC00
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650B4D7	1_2_0650B4D7
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650B4E8	1_2_0650B4E8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06500490	1_2_06500490
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E4B0	1_2_0650E4B0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065004A0	1_2_065004A0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E4A0	1_2_0650E4A0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650ED50	1_2_0650ED50
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06500D51	1_2_06500D51
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650ED60	1_2_0650ED60
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06507D90	1_2_06507D90
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650BD98	1_2_0650BD98
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650BD88	1_2_0650BD88
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650FA59	1_2_0650FA59
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650FA68	1_2_0650FA68
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650CAA0	1_2_0650CAA0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650D350	1_2_0650D350
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650D340	1_2_0650D340
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065073D8	1_2_065073D8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650DBF1	1_2_0650DBF1
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065073E8	1_2_065073E8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E058	1_2_0650E058
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E049	1_2_0650E049
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06503860	1_2_06503860
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650001E	1_2_0650001E
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065008F0	1_2_065008F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E8F8	1_2_0650E8F8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650B940	1_2_0650B940
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06500900	1_2_06500900
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650E908	1_2_0650E908
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650B930	1_2_0650B930
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650C1F0	1_2_0650C1F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650C1E0	1_2_0650C1E0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065011B0	1_2_065011B0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650F1B8	1_2_0650F1B8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0650F1A9	1_2_0650F1A9
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653AA58	1_2_0653AA58
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653D670	1_2_0653D670
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06538608	1_2_06538608
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653B6E8	1_2_0653B6E8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653C388	1_2_0653C388
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06538C51	1_2_06538C51
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653A408	1_2_0653A408
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653D028	1_2_0653D028
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653B0A0	1_2_0653B0A0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653BD38	1_2_0653BD38
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653C9D8	1_2_0653C9D8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065311A0	1_2_065311A0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653AA48	1_2_0653AA48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535A70	1_2_06535A70
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653D662	1_2_0653D662
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535A60	1_2_06535A60
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535618	1_2_06535618
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06538602	1_2_06538602
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653560A	1_2_0653560A
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653B6D9	1_2_0653B6D9
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535EC8	1_2_06535EC8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535EB8	1_2_06535EB8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06536778	1_2_06536778
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653C378	1_2_0653C378
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06536312	1_2_06536312
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06533730	1_2_06533730
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06536320	1_2_06536320
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06536BD0	1_2_06536BD0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06536BC1	1_2_06536BC1
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653A3F8	1_2_0653A3F8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065333B8	1_2_065333B8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065333A8	1_2_065333A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537050	1_2_06537050
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530040	1_2_06530040
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537049	1_2_06537049
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06532818	1_2_06532818
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653D018	1_2_0653D018
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06532807	1_2_06532807
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530006	1_2_06530006
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06534430	1_2_06534430
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065308F0	1_2_065308F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065378F0	1_2_065378F0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065308E0	1_2_065308E0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537497	1_2_06537497
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530498	1_2_06530498
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530488	1_2_06530488
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653B08F	1_2_0653B08F
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065374A8	1_2_065374A8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537D58	1_2_06537D58
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530D48	1_2_06530D48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537D48	1_2_06537D48
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06537900	1_2_06537900
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06530D39	1_2_06530D39
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653BD28	1_2_0653BD28
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653C9C8	1_2_0653C9C8
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06531191	1_2_06531191
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06535198	1_2_06535198
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_0653518A	1_2_0653518A
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065381B0	1_2_065381B0
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_065381A0	1_2_065381A0

Source: RFQ 306 & 307.exe, 00000000.00000002.974155245.00000000024F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000000.957874288.00000000001EE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamexoyT.exe( vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.971787545.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.977662571.0000000006980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.981966686.0000000008950000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.974155245.00000000025E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTL.dll" vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000000.00000002.974155245.00000000024E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe, 00000001.00000002.3417770143.0000000000937000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs RFQ 306 & 307.exe
Source: RFQ 306 & 307.exe	Binary or memory string: OriginalFilenamexoyT.exe( vs RFQ 306 & 307.exe

Source: RFQ 306 & 307.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: RFQ 306 & 307.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, -C.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, TWFk1hsDU74sZHvD9d.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, TWFk1hsDU74sZHvD9d.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, TWFk1hsDU74sZHvD9d.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, TWFk1hsDU74sZHvD9d.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ 306 & 307.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Mutant created: NULL

Source: RFQ 306 & 307.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: RFQ 306 & 307.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002ACD000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002ABD000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002B03000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3420124355.0000000002ADB000.00000004.00000800.00020000.00000000.sdmp, RFQ 306 & 307.exe, 00000001.00000002.3421677424.000000000390E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: RFQ 306 & 307.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\RFQ 306 & 307.exe "C:\Users\user\Desktop\RFQ 306 & 307.exe"
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process created: C:\Users\user\Desktop\RFQ 306 & 307.exe "C:\Users\user\Desktop\RFQ 306 & 307.exe"
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process created: C:\Users\user\Desktop\RFQ 306 & 307.exe "C:\Users\user\Desktop\RFQ 306 & 307.exe"	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: RFQ 306 & 307.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: RFQ 306 & 307.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: RFQ 306 & 307.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: xoyT.pdb source: RFQ 306 & 307.exe
Source:	Binary string: xoyT.pdbSHA256\ source: RFQ 306 & 307.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	.Net Code: TWE9lrV68k System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	.Net Code: TWE9lrV68k System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 0_2_0674975F push 1806B439h; retf	0_2_0674976D
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06502E60 push esp; iretd	1_2_06502E79
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06506F13 push es; ret	1_2_06506FE4
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06506F8B push es; ret	1_2_06506FE4
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Code function: 1_2_06507059 push es; iretd	1_2_0650705C

Source: RFQ 306 & 307.exe

Static PE information: section name: .text entropy: 7.776419308097989

Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, oLLT1fuQKA0ItyO97rK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KVcVjNjWjo', 'loAVQYftFu', 'QWKVWKbwrY', 'QvEVVf0QW2', 'kOYVKggWn7', 'GR7VtPa7Kc', 'dKWV1QxyGh'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, DsaEphH2MIsygfMQr6.cs	High entropy of concatenated method names: 'kAmo2w1Khx', 'DFgohMIYlc', 'vkPocXlFi8', 'UH7owrYKTr', 'T3IorIFcSx', 'h48o88DSQC', 'n3koS2K0fW', 'Ll8omefWxV', 'JP2ojwv0dQ', 'iUeoQvYi0B'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, XVPZfyhhPA7FaJJ7JP.cs	High entropy of concatenated method names: 'OHvlhh39Q', 'vUU20nZ8J', 'ibth9Hu5I', 'F4EM4a37w', 'IWWwJl1FJ', 'xC6bKYMMU', 'rFK9dZlnhCuD9j2vNl', 'HwelMtrRIe9B1INrs8', 'tvcmDoNJC', 'd0yQFqe8j'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, DkuypGxrD9A15a6kja.cs	High entropy of concatenated method names: 'Dispose', 'd8WG0T06OT', 'gbWTO8YOFT', 'diJVFJUj5E', 'ww6G67MlCL', 'tXnGzbwQ6Z', 'ProcessDialogKey', 'YRSTBwQ6Oy', 'lp4TGJxxk1', 'uhQTToi43l'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, F4dCuiQAR63FGGlGah.cs	High entropy of concatenated method names: 'IqkGyhyWmV', 'fWsGNkwfQb', 'AjtGqoi7cN', 'DfgGRZ8kpB', 'lrQGrQdfZw', 'JUgG8E5ovw', 'QsWYvWaoVfTxQ0xFHD', 'qCUVeQeuIgjCDN5lVp', 'S1VGG6jJNM', 'FCtGkobYPv'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, BvJWnU2ehoJXWiR5lk.cs	High entropy of concatenated method names: 'dTFju1oLxU', 'DeQjOep4kZ', 'ROUjZ1ZleC', 'hkIjYrL91L', 'PpPj3W18g5', 'fr3jUqesCr', 'tdjjXS4Cic', 'JHcjv3a7Iq', 'VlxjgfoUV4', 'MjLjas20Qf'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, EKZyeY3TsjB3XWq34g.cs	High entropy of concatenated method names: 'EaljrSegLn', 'KPKjSAxnUj', 'pohjjfnblG', 'Oq2jWTXqF4', 'aucjKs7Qnl', 'rrxj1sxRGG', 'Dispose', 'A4PmI0HCAN', 'elKmAbO019', 'ggfmoh2bj8'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, Lynkvxipa86qHxAK7X.cs	High entropy of concatenated method names: 'iQWSisEE9M', 'CN9S6TicVV', 'odmmBkcspF', 'yVXmGJPFHA', 'h64S5uEP2V', 'rwISEPftH3', 'dGwSJByre8', 'tVjSs0A4po', 'z19SCw6avV', 'ApVSHr6uyH'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, uUKjitjVF91h3NcCAo.cs	High entropy of concatenated method names: 'mdty7Jg7Ll', 'Hm4yLYRYmi', 'A6iylsInuN', 'NImy2y0MJb', 'tOjypWc9qr', 'OIcyh3tpdt', 'AWmyMEYR0D', 'XMiycdyx3C', 'xr6ywBK3XC', 'OXnybLBYgX'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, TWFk1hsDU74sZHvD9d.cs	High entropy of concatenated method names: 'e9lAs3A8yl', 'xhbACW2EMJ', 'PjFAH0KHNp', 'bX0Ax5WTiY', 'Fb0AFF8f49', 'W0NAey2STN', 'I9HAP783nC', 'Md0AiVB7FT', 'WNRA0mPBjh', 'GX2A6u4L5c'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, E7fD9jXGOJD1inusCC.cs	High entropy of concatenated method names: 'eDrDdxNkSc', 'qcvDAHDhMk', 'dUiDnWKbpD', 'RnfDyZfl28', 'lctDNumexR', 'fG5nFZtmd0', 'IBFneM858q', 'krxnP22EH3', 'b5NnihYpC1', 'Eqkn0a0aLf'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, CdBfC3uupV4v5U2jLkx.cs	High entropy of concatenated method names: 'l5FQ6tRFQQ', 'goeQz9tevY', 'fU6WBrNeNS', 'JgjWGr3MVk', 'bg6WT7H32M', 'bjdWkgUonY', 's7HW9ST0WP', 'Wh8Wd33bZV', 'mOSWIXCuYu', 'zNCWAlM47d'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, u4hKfXuvyTf2ayl5SKl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ESWQ5xADun', 'h5EQEBtPH0', 'zjqQJ4ML4L', 'Oe9QsGLny0', 'zpbQCsiqvM', 'a4YQHDS2wm', 'RH7QxnvygP'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, pNFTLtP5U3nquNxMVY.cs	High entropy of concatenated method names: 'fjlraQJRNI', 'F3OrEIZYGS', 'me1rsjhdvy', 'zKjrCSajbl', 'ELArORYUvP', 'Ya7rZMdkVG', 'dMkrYwYmsO', 'lbYr35Irxu', 'k1yrUApJlW', 'SF9rXtDhWQ'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, sEwaNB7v2upKp0WSxd.cs	High entropy of concatenated method names: 'ToString', 'UfY85ZaQM0', 'pI88O6xtH3', 'zwI8ZRlFMa', 'yt68Yi0E1D', 'vd683bBxpl', 'wvG8UiraW2', 'zrH8XOwjw9', 'W7d8v1Q1qL', 'otA8gWPBCP'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, RhEa5hWtp6VJt1yayH.cs	High entropy of concatenated method names: 'eMD4cIec5q', 'JPn4wU0VbP', 'SK14uSPl5v', 'QSM4OCJWq4', 'cxX4Y9CauZ', 'dGh43LMNUy', 'qZp4XgRdTR', 'VX24vU8f6k', 'M0N4aCDLR4', 'VTd45vdXCs'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	High entropy of concatenated method names: 'MNDkdcTblx', 'pS6kI5VjBd', 'OeYkAtInfU', 'DwEkodQO8q', 'yKYknFTUbH', 'UEIkDVyPbA', 'E0nkyqHk7T', 'mQ2kNlCjBX', 'e1Tkfs8hr3', 'AGBkqtRE5m'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, z1GVU4kGypXRGrLIRZ.cs	High entropy of concatenated method names: 'oVBQopk4Y7', 'w55QnWwt2l', 'db4QDe9mB3', 'zimQy1kPql', 'C2IQj8kH7M', 'IMdQNIfLh2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, WrkQmnzvYLcCGunCKP.cs	High entropy of concatenated method names: 'QsoQhSqkr6', 'R0bQcd09dP', 'taXQwUGKnU', 'bn3QuXZfxb', 'iZLQORgfaD', 'B4RQYiUqNt', 'n75Q3d91RN', 'UCwQ1L5vIP', 'nrcQ7rI36p', 'g4wQLPrB2L'
Source: 0.2.RFQ 306 & 307.exe.6980000.4.raw.unpack, wQqLynYYpa7i8cEsW1.cs	High entropy of concatenated method names: 'mhwyIrFgb7', 'Dk0yoAiG5Y', 'UQMyDtDKT8', 'RYPD6dgfQX', 'AUZDz24nvq', 'akuyBhoZPK', 'z4FyGBUR99', 'VfMyTMNf2M', 't0Xykv8ywm', 'lSjy97DPcc'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, oLLT1fuQKA0ItyO97rK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'KVcVjNjWjo', 'loAVQYftFu', 'QWKVWKbwrY', 'QvEVVf0QW2', 'kOYVKggWn7', 'GR7VtPa7Kc', 'dKWV1QxyGh'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, DsaEphH2MIsygfMQr6.cs	High entropy of concatenated method names: 'kAmo2w1Khx', 'DFgohMIYlc', 'vkPocXlFi8', 'UH7owrYKTr', 'T3IorIFcSx', 'h48o88DSQC', 'n3koS2K0fW', 'Ll8omefWxV', 'JP2ojwv0dQ', 'iUeoQvYi0B'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, XVPZfyhhPA7FaJJ7JP.cs	High entropy of concatenated method names: 'OHvlhh39Q', 'vUU20nZ8J', 'ibth9Hu5I', 'F4EM4a37w', 'IWWwJl1FJ', 'xC6bKYMMU', 'rFK9dZlnhCuD9j2vNl', 'HwelMtrRIe9B1INrs8', 'tvcmDoNJC', 'd0yQFqe8j'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, DkuypGxrD9A15a6kja.cs	High entropy of concatenated method names: 'Dispose', 'd8WG0T06OT', 'gbWTO8YOFT', 'diJVFJUj5E', 'ww6G67MlCL', 'tXnGzbwQ6Z', 'ProcessDialogKey', 'YRSTBwQ6Oy', 'lp4TGJxxk1', 'uhQTToi43l'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, F4dCuiQAR63FGGlGah.cs	High entropy of concatenated method names: 'IqkGyhyWmV', 'fWsGNkwfQb', 'AjtGqoi7cN', 'DfgGRZ8kpB', 'lrQGrQdfZw', 'JUgG8E5ovw', 'QsWYvWaoVfTxQ0xFHD', 'qCUVeQeuIgjCDN5lVp', 'S1VGG6jJNM', 'FCtGkobYPv'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, BvJWnU2ehoJXWiR5lk.cs	High entropy of concatenated method names: 'dTFju1oLxU', 'DeQjOep4kZ', 'ROUjZ1ZleC', 'hkIjYrL91L', 'PpPj3W18g5', 'fr3jUqesCr', 'tdjjXS4Cic', 'JHcjv3a7Iq', 'VlxjgfoUV4', 'MjLjas20Qf'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, EKZyeY3TsjB3XWq34g.cs	High entropy of concatenated method names: 'EaljrSegLn', 'KPKjSAxnUj', 'pohjjfnblG', 'Oq2jWTXqF4', 'aucjKs7Qnl', 'rrxj1sxRGG', 'Dispose', 'A4PmI0HCAN', 'elKmAbO019', 'ggfmoh2bj8'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, Lynkvxipa86qHxAK7X.cs	High entropy of concatenated method names: 'iQWSisEE9M', 'CN9S6TicVV', 'odmmBkcspF', 'yVXmGJPFHA', 'h64S5uEP2V', 'rwISEPftH3', 'dGwSJByre8', 'tVjSs0A4po', 'z19SCw6avV', 'ApVSHr6uyH'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, uUKjitjVF91h3NcCAo.cs	High entropy of concatenated method names: 'mdty7Jg7Ll', 'Hm4yLYRYmi', 'A6iylsInuN', 'NImy2y0MJb', 'tOjypWc9qr', 'OIcyh3tpdt', 'AWmyMEYR0D', 'XMiycdyx3C', 'xr6ywBK3XC', 'OXnybLBYgX'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, TWFk1hsDU74sZHvD9d.cs	High entropy of concatenated method names: 'e9lAs3A8yl', 'xhbACW2EMJ', 'PjFAH0KHNp', 'bX0Ax5WTiY', 'Fb0AFF8f49', 'W0NAey2STN', 'I9HAP783nC', 'Md0AiVB7FT', 'WNRA0mPBjh', 'GX2A6u4L5c'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, E7fD9jXGOJD1inusCC.cs	High entropy of concatenated method names: 'eDrDdxNkSc', 'qcvDAHDhMk', 'dUiDnWKbpD', 'RnfDyZfl28', 'lctDNumexR', 'fG5nFZtmd0', 'IBFneM858q', 'krxnP22EH3', 'b5NnihYpC1', 'Eqkn0a0aLf'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, CdBfC3uupV4v5U2jLkx.cs	High entropy of concatenated method names: 'l5FQ6tRFQQ', 'goeQz9tevY', 'fU6WBrNeNS', 'JgjWGr3MVk', 'bg6WT7H32M', 'bjdWkgUonY', 's7HW9ST0WP', 'Wh8Wd33bZV', 'mOSWIXCuYu', 'zNCWAlM47d'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, u4hKfXuvyTf2ayl5SKl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ESWQ5xADun', 'h5EQEBtPH0', 'zjqQJ4ML4L', 'Oe9QsGLny0', 'zpbQCsiqvM', 'a4YQHDS2wm', 'RH7QxnvygP'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, pNFTLtP5U3nquNxMVY.cs	High entropy of concatenated method names: 'fjlraQJRNI', 'F3OrEIZYGS', 'me1rsjhdvy', 'zKjrCSajbl', 'ELArORYUvP', 'Ya7rZMdkVG', 'dMkrYwYmsO', 'lbYr35Irxu', 'k1yrUApJlW', 'SF9rXtDhWQ'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, sEwaNB7v2upKp0WSxd.cs	High entropy of concatenated method names: 'ToString', 'UfY85ZaQM0', 'pI88O6xtH3', 'zwI8ZRlFMa', 'yt68Yi0E1D', 'vd683bBxpl', 'wvG8UiraW2', 'zrH8XOwjw9', 'W7d8v1Q1qL', 'otA8gWPBCP'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, RhEa5hWtp6VJt1yayH.cs	High entropy of concatenated method names: 'eMD4cIec5q', 'JPn4wU0VbP', 'SK14uSPl5v', 'QSM4OCJWq4', 'cxX4Y9CauZ', 'dGh43LMNUy', 'qZp4XgRdTR', 'VX24vU8f6k', 'M0N4aCDLR4', 'VTd45vdXCs'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, q1BKUVwJQkg2RGYPU1.cs	High entropy of concatenated method names: 'MNDkdcTblx', 'pS6kI5VjBd', 'OeYkAtInfU', 'DwEkodQO8q', 'yKYknFTUbH', 'UEIkDVyPbA', 'E0nkyqHk7T', 'mQ2kNlCjBX', 'e1Tkfs8hr3', 'AGBkqtRE5m'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, z1GVU4kGypXRGrLIRZ.cs	High entropy of concatenated method names: 'oVBQopk4Y7', 'w55QnWwt2l', 'db4QDe9mB3', 'zimQy1kPql', 'C2IQj8kH7M', 'IMdQNIfLh2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, WrkQmnzvYLcCGunCKP.cs	High entropy of concatenated method names: 'QsoQhSqkr6', 'R0bQcd09dP', 'taXQwUGKnU', 'bn3QuXZfxb', 'iZLQORgfaD', 'B4RQYiUqNt', 'n75Q3d91RN', 'UCwQ1L5vIP', 'nrcQ7rI36p', 'g4wQLPrB2L'
Source: 0.2.RFQ 306 & 307.exe.368f7b0.2.raw.unpack, wQqLynYYpa7i8cEsW1.cs	High entropy of concatenated method names: 'mhwyIrFgb7', 'Dk0yoAiG5Y', 'UQMyDtDKT8', 'RYPD6dgfQX', 'AUZDz24nvq', 'akuyBhoZPK', 'z4FyGBUR99', 'VfMyTMNf2M', 't0Xykv8ywm', 'lSjy97DPcc'

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 24E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 44E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 8C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 9C20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 9E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: AE40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Memory allocated: DA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598669	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598097	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597065	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596061	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595612	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595372	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595112	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594016	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Window / User API: threadDelayed 1446			Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Window / User API: threadDelayed 8391			Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 6796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 4772	Thread sleep count: 1446 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 4772	Thread sleep count: 8391 > 30	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598669s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598338s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -598097s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -597065s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -596061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595730s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595612s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595372s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -595112s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe TID: 5356	Thread sleep time: -594016s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598669	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598452	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598338	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 598097	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597641	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 597065	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 596061	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595844	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595612	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595372	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595265	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 595112	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594938	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594813	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594344	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Thread delayed: delay time: 594016	Jump to behavior

Source: RFQ 306 & 307.exe, 00000001.00000002.3418780169.0000000000B06000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Code function: 1_2_06507B70 LdrInitializeThunk,

1_2_06507B70

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Memory written: C:\Users\user\Desktop\RFQ 306 & 307.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Process created: C:\Users\user\Desktop\RFQ 306 & 307.exe "C:\Users\user\Desktop\RFQ 306 & 307.exe"

Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Users\user\Desktop\RFQ 306 & 307.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Users\user\Desktop\RFQ 306 & 307.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3420124355.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3420124355.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\RFQ 306 & 307.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.RFQ 306 & 307.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3577b80.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.RFQ 306 & 307.exe.3557160.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.3417519424.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3420124355.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.974808957.00000000034E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3420124355.0000000002881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 716, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RFQ 306 & 307.exe PID: 5560, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RFQ 306 & 307.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
RFQ 306 & 307.exe