Edit tour

Windows Analysis Report
Imprimir_Entrada.exe

Overview

General Information

Sample name:	Imprimir_Entrada.exe
Analysis ID:	1664024
MD5:	4c9698e7feffaa7fe78749eacd39efbc
SHA1:	7b123f6a4475ac602c561dc485447f9e1b430dcf
SHA256:	b387dca776ec20a5f7c8cc1df2a473f7b76520b6a33e2993850a21999cf612b3
Tags:	exeuser-abuse_ch
Infos:

Detection

Quasar, StormKitty

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Quasar RAT

Yara detected StormKitty Stealer

.NET source code contains potential unpacker

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Joe Sandbox ML detected suspicious sample

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Imprimir_Entrada.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\Imprimir_Entrada.exe" MD5: 4C9698E7FEFFAA7FE78749EACD39EFBC)

schtasks.exe (PID: 6168 cmdline: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Client.exe (PID: 4212 cmdline: "C:\Users\user\AppData\Roaming\SubDir\Client.exe" MD5: 4C9698E7FEFFAA7FE78749EACD39EFBC)

schtasks.exe (PID: 5936 cmdline: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 7360 cmdline: "netsh" wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Client.exe (PID: 7188 cmdline: C:\Users\user\AppData\Roaming\SubDir\Client.exe MD5: 4C9698E7FEFFAA7FE78749EACD39EFBC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Imprimir_Entrada.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\SubDir\Client.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0000000D.00000002.1320232290.0000026E98206000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Imprimir_Entrada.exe PID: 6604	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Imprimir_Entrada.exe PID: 6604	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client.exe PID: 4212	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client.exe PID: 4212	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: Client.exe PID: 7188	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.Imprimir_Entrada.exe.11f6c7d0000.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.0.Imprimir_Entrada.exe.11f6c190000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Sigma Signatures

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\Client.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\Client.exe, ParentProcessId: 4212, ParentProcessName: Client.exe, ProcessCommandLine: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, ProcessId: 5936, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Imprimir_Entrada.exe", ParentImage: C:\Users\user\Desktop\Imprimir_Entrada.exe, ParentProcessId: 6604, ParentProcessName: Imprimir_Entrada.exe, ProcessCommandLine: "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f, ProcessId: 6168, ProcessName: schtasks.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: "netsh" wlan show profiles, CommandLine: "netsh" wlan show profiles, CommandLine|base64offset|contains: V, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\SubDir\Client.exe", ParentImage: C:\Users\user\AppData\Roaming\SubDir\Client.exe, ParentProcessId: 4212, ParentProcessName: Client.exe, ProcessCommandLine: "netsh" wlan show profiles, ProcessId: 7360, ProcessName: netsh.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\LM6C8EYHXFcK.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen7

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

ReversingLabs: Detection: 33%

Multi AV Scanner detection for submitted file

Source: Imprimir_Entrada.exe	Virustotal: Detection: 48%			Perma Link
Source: Imprimir_Entrada.exe	ReversingLabs: Detection: 33%

Yara detected Quasar RAT

Source: Yara match	File source: Imprimir_Entrada.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Imprimir_Entrada.exe.11f6c190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1320232290.0000026E98206000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Imprimir_Entrada.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Client.exe, type: DROPPED

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 99.8%

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Code function: 4_2_00007FF88B6F147E CryptUnprotectData,

4_2_00007FF88B6F147E

Source: Imprimir_Entrada.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.6:49689 version: TLS 1.2

Source: Imprimir_Entrada.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.sharpdx.pdb.compressedx source: Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed\|\|\|SharpDX.DXGI.pdb\|D73E59804E3EE494A4612185771F7F67B2FD64AE\|34752 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed8 source: Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed\|\|\|SharpDX.pdb\|1A7C10AA582CCEEBFFD9BC77A11353AAAE6417E9\|42824 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: ClientClient.exemscorlibSystem.Windows.FormsPulsar.CommonSystemSystem.DrawingSystem.CoreSystem.Runtime.SerializationNAudio.WinMMNAudio.CoreNAudio.WasapiGma.System.MouseKeyHookSystem.IO.CompressionSystem.ManagementSharpDX.Direct3D11SharpDX.DXGISharpDXAForge.Video.DirectShowAForge.VideoSystem.SecurityNAudio.WinFormsSystem.IO.Compression.FileSystemSystem.Webnetstandarduser32.dllkernel32.dlliphlpapi.dllDbgHelp.dllgdi32.dllntdll.dllrstrtmgr.dllbcrypt.dllcrypt32.dllmsvcrt.dlladvapi32.dllkernelbase.dllucrtbase.dllntdllwin32u.dllPulsar.Client.Properties.Resources.resourcescostura.aforge.dll.compressedcostura.aforge.video.dll.compressedcostura.aforge.video.directshow.dll.compressedcostura.gma.system.mousekeyhook.dll.compressedcostura.naudio.core.dll.compressedcostura.naudio.wasapi.dll.compressedcostura.naudio.winforms.dll.compressedcostura.naudio.winmm.dll.compressedcostura.protobuf-net.dll.compressedcostura.sharpdx.dll.compressedcostura.sharpdx.pdb.compressedcostura.sharpdx.direct3d11.dll.compressedcostura.sharpdx.direct3d11.pdb.compressedcostura.sharpdx.dxgi.dll.compressedcostura.sharpdx.dxgi.pdb.compressedcostura.pulsar.common.dll.compressedcostura.metadata source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: #costura.sharpdx.dxgi.pdb.compressed source: Imprimir_Entrada.exe, 00000000.00000002.1271263351.0000011F00001000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000D.00000002.1322310229.0000026E99CC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed\|\|\|SharpDX.Direct3D11.pdb\|A2259A45EA284247B3AA65EC9C1DBEBD47FE208F\|78220 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: System.IO.Compression.pdbqj source: Client.exe, 00000004.00000002.3698641246.000001D850C80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Compression.pdb source: Client.exe, 00000004.00000002.3690793107.000001D8386C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: .pdbHJ source: Client.exe, 00000004.00000002.3689486754.000000C38DCF6000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed source: Imprimir_Entrada.exe, 00000000.00000002.1271263351.0000011F00001000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000D.00000002.1322310229.0000026E99CC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256= source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.6:49687 -> 176.65.141.202:4782

Source: Joe Sandbox View	IP Address: 15.204.213.5 15.204.213.5
Source: Joe Sandbox View	IP Address: 15.204.213.5 15.204.213.5

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipwho.is

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202
Source: unknown	TCP traffic detected without corresponding DNS query: 176.65.141.202

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0Host: ipwho.isConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ipwho.is

Source: Client.exe, 00000004.00000002.3689801664.000001D836900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Client.exe, 00000004.00000002.3697591915.000001D850B80000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Client.exe, 00000004.00000002.3690793107.000001D8384E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Client.exe, 00000004.00000002.3690793107.000001D8384E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/iweuuebcijm
Source: Imprimir_Entrada.exe, 00000000.00000002.1271263351.0000011F00001000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D838328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: Client.exe, 00000004.00000002.3690793107.000001D83865C000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D8388E7000.00000004.00000800.00020000.00000000.sdmp, LM6C8EYHXFcK.exe.4.dr	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: Client.exe, 00000004.00000002.3700436204.000001D850E90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/gmamaladze/globalmousekeyhook
Source: Client.exe, 00000004.00000002.3700436204.000001D850E90000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/gmamaladze/globalmousekeyhookF
Source: Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net6
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Client.exe, 00000004.00000002.3690793107.000001D838485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is
Source: Client.exe, 00000004.00000002.3690793107.000001D838485000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ipwho.is/
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D838328000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Client.exe, 00000004.00000002.3698641246.000001D850D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Client.exe, 00000004.00000002.3696329902.000001D848495000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Client.exe, 00000004.00000002.3698641246.000001D850D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: Client.exe, 00000004.00000002.3698641246.000001D850D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: Client.exe, 00000004.00000002.3698641246.000001D850D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443

Source: unknown

HTTPS traffic detected: 15.204.213.5:443 -> 192.168.2.6:49689 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\SubDir\Client.exe

Jump to behavior

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: Imprimir_Entrada.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Imprimir_Entrada.exe.11f6c190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1320232290.0000026E98206000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Imprimir_Entrada.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Client.exe, type: DROPPED

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Code function: 4_2_00007FF88B4CCC46 CreateDesktopW,

4_2_00007FF88B4CCC46

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E0F96	0_2_00007FF88B4E0F96
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E16C5	0_2_00007FF88B4E16C5
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E1AF2	0_2_00007FF88B4E1AF2
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E65B6	0_2_00007FF88B4E65B6
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E16FA	0_2_00007FF88B4E16FA
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E0698	0_2_00007FF88B4E0698
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4DFC30	4_2_00007FF88B4DFC30
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4BC9B8	4_2_00007FF88B4BC9B8
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4BD065	4_2_00007FF88B4BD065
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4F6010	4_2_00007FF88B4F6010
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4CEF95	4_2_00007FF88B4CEF95
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B0F96	4_2_00007FF88B4B0F96
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4D9DD6	4_2_00007FF88B4D9DD6
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4C0770	4_2_00007FF88B4C0770
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4C0710	4_2_00007FF88B4C0710
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4C0730	4_2_00007FF88B4C0730
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4CA7A0	4_2_00007FF88B4CA7A0
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B0508	4_2_00007FF88B4B0508
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4C4B75	4_2_00007FF88B4C4B75
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B1366	4_2_00007FF88B4B1366
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B130D	4_2_00007FF88B4B130D
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4C0170	4_2_00007FF88B4C0170
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4E510D	4_2_00007FF88B4E510D
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B0698	4_2_00007FF88B4B0698
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B6789DF	4_2_00007FF88B6789DF
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B67217D	4_2_00007FF88B67217D
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B6F2DD0	4_2_00007FF88B6F2DD0
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B6F375D	4_2_00007FF88B6F375D
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C16C5	13_2_00007FF88B4C16C5
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C1AEB	13_2_00007FF88B4C1AEB
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C13DD	13_2_00007FF88B4C13DD
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C0F96	13_2_00007FF88B4C0F96
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C65B6	13_2_00007FF88B4C65B6
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C1427	13_2_00007FF88B4C1427
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C16F2	13_2_00007FF88B4C16F2

Source: Imprimir_Entrada.exe, 00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePulsar.Common.dll. vs Imprimir_Entrada.exe
Source: Imprimir_Entrada.exe, 00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs Imprimir_Entrada.exe
Source: Imprimir_Entrada.exe, 00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameClient.exe" vs Imprimir_Entrada.exe
Source: Imprimir_Entrada.exe, 00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePulsar.Common.dll. vs Imprimir_Entrada.exe
Source: Imprimir_Entrada.exe	Binary or memory string: OriginalFilenameClient.exe" vs Imprimir_Entrada.exe

Source: Imprimir_Entrada.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Imprimir_Entrada.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Client.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Imprimir_Entrada.exe, tDiEDOl99m5ZDzK3AIdjFFQ.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: LM6C8EYHXFcK.exe.4.dr, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteInteger
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteBytes
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.WriteMessage
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadWriter.cs	Suspicious method names: .PayloadWriter.Dispose
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadInteger
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadBytes
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.ReadMessage
Source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, PayloadReader.cs	Suspicious method names: .PayloadReader.Dispose

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/6@1/2

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

File created: C:\Users\user\AppData\Roaming\SubDir

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6588:120:WilError_03
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\d7e032b1-039d-4eff-a4d0-a08a88c753f5
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

File created: C:\Users\user\AppData\Local\Temp\LM6C8EYHXFcK.exe

Jump to behavior

Source: Imprimir_Entrada.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Imprimir_Entrada.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Client.exe, 00000004.00000002.3690793107.000001D8386CF000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D838734000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Imprimir_Entrada.exe	Virustotal: Detection: 48%
Source: Imprimir_Entrada.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

File read: C:\Users\user\Desktop\Imprimir_Entrada.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Imprimir_Entrada.exe "C:\Users\user\Desktop\Imprimir_Entrada.exe"
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Client.exe "C:\Users\user\AppData\Roaming\SubDir\Client.exe"
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\SubDir\Client.exe C:\Users\user\AppData\Roaming\SubDir\Client.exe
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles
Source: C:\Windows\System32\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Client.exe "C:\Users\user\AppData\Roaming\SubDir\Client.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Imprimir_Entrada.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Imprimir_Entrada.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Imprimir_Entrada.exe

Static file information: File size 1210880 > 1048576

Source: Imprimir_Entrada.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x109400

Source: Imprimir_Entrada.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: costura.sharpdx.pdb.compressedx source: Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed\|\|\|SharpDX.DXGI.pdb\|D73E59804E3EE494A4612185771F7F67B2FD64AE\|34752 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: costura.sharpdx.dxgi.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed8 source: Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed\|\|\|SharpDX.pdb\|1A7C10AA582CCEEBFFD9BC77A11353AAAE6417E9\|42824 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: ClientClient.exemscorlibSystem.Windows.FormsPulsar.CommonSystemSystem.DrawingSystem.CoreSystem.Runtime.SerializationNAudio.WinMMNAudio.CoreNAudio.WasapiGma.System.MouseKeyHookSystem.IO.CompressionSystem.ManagementSharpDX.Direct3D11SharpDX.DXGISharpDXAForge.Video.DirectShowAForge.VideoSystem.SecurityNAudio.WinFormsSystem.IO.Compression.FileSystemSystem.Webnetstandarduser32.dllkernel32.dlliphlpapi.dllDbgHelp.dllgdi32.dllntdll.dllrstrtmgr.dllbcrypt.dllcrypt32.dllmsvcrt.dlladvapi32.dllkernelbase.dllucrtbase.dllntdllwin32u.dllPulsar.Client.Properties.Resources.resourcescostura.aforge.dll.compressedcostura.aforge.video.dll.compressedcostura.aforge.video.directshow.dll.compressedcostura.gma.system.mousekeyhook.dll.compressedcostura.naudio.core.dll.compressedcostura.naudio.wasapi.dll.compressedcostura.naudio.winforms.dll.compressedcostura.naudio.winmm.dll.compressedcostura.protobuf-net.dll.compressedcostura.sharpdx.dll.compressedcostura.sharpdx.pdb.compressedcostura.sharpdx.direct3d11.dll.compressedcostura.sharpdx.direct3d11.pdb.compressedcostura.sharpdx.dxgi.dll.compressedcostura.sharpdx.dxgi.pdb.compressedcostura.pulsar.common.dll.compressedcostura.metadata source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: #costura.sharpdx.dxgi.pdb.compressed source: Imprimir_Entrada.exe, 00000000.00000002.1271263351.0000011F00001000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3690793107.000001D838311000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000D.00000002.1322310229.0000026E99CC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.direct3d11.pdb.compressed\|\|\|SharpDX.Direct3D11.pdb\|A2259A45EA284247B3AA65EC9C1DBEBD47FE208F\|78220 source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: System.IO.Compression.pdbqj source: Client.exe, 00000004.00000002.3698641246.000001D850C80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.IO.Compression.pdb source: Client.exe, 00000004.00000002.3690793107.000001D8386C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: costura.sharpdx.pdb.compressed source: Imprimir_Entrada.exe, Client.exe.0.dr
Source:	Binary string: .pdbHJ source: Client.exe, 00000004.00000002.3689486754.000000C38DCF6000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: )costura.sharpdx.direct3d11.pdb.compressed source: Imprimir_Entrada.exe, 00000000.00000002.1271263351.0000011F00001000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 0000000D.00000002.1322310229.0000026E99CC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256= source: Client.exe, 00000004.00000002.3700500597.000001D850EA0000.00000004.08000000.00040000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D8483B5000.00000004.00000800.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3696329902.000001D84832D000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Imprimir_Entrada.exe, AssemblyLoader.cs	.Net Code: _0002 System.Reflection.Assembly.Load(byte[])
Source: Imprimir_Entrada.exe, M9DHHB2aKZF5bqXz.cs	.Net Code: YC96KFZk7zpvJ8
Source: Imprimir_Entrada.exe, M9DHHB2aKZF5bqXz.cs	.Net Code: xT5WHZeaapYVz4XZ
Source: Imprimir_Entrada.exe, z7P4mD4S2Uhozt10gfuJVQKUlCSv3.cs	.Net Code: _0002 System.Reflection.Assembly.Load(byte[])
Source: 4.2.Client.exe.1d848365998.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 4.2.Client.exe.1d848365998.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 4.2.Client.exe.1d848365998.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 4.2.Client.exe.1d848365998.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 4.2.Client.exe.1d848365998.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match

File source: Process Memory Space: Imprimir_Entrada.exe PID: 6604, type: MEMORYSTR

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E00BD pushad ; iretd	0_2_00007FF88B4E00C1
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Code function: 0_2_00007FF88B4E7558 push ebx; iretd	0_2_00007FF88B4E756A
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B39D2A5 pushad ; iretd	4_2_00007FF88B39D2A6
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4E3316 pushfd ; retn FFFFh	4_2_00007FF88B4E3929
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4E6140 push cs; retn 5F4Ch	4_2_00007FF88B4E631F
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B00BD pushad ; iretd	4_2_00007FF88B4B00C1
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B4B8169 push ebx; ret	4_2_00007FF88B4B816A
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 4_2_00007FF88B67714B push ds; retf	4_2_00007FF88B67715F
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Code function: 13_2_00007FF88B4C00BD pushad ; iretd	13_2_00007FF88B4C00C1

Source: Imprimir_Entrada.exe	Static PE information: section name: .text entropy: 7.803532123820447
Source: Client.exe.0.dr	Static PE information: section name: .text entropy: 7.803532123820447

Source: Imprimir_Entrada.exe, M9DHHB2aKZF5bqXz.cs	High entropy of concatenated method names: '_0002', '_0002', '_0002', '_0002', '_0002', '_0002', '_0002', '_0002', 'HAbiE0kzYK', '_0002'
Source: Imprimir_Entrada.exe, g66CQ6NBiVEUzYy.cs	High entropy of concatenated method names: 'PortConnectionAntiVM', 'EmulationTimingCheck', 'AVXInstructions', 'RDRANDInstruction', 'FlagsManipulationInstructions', '_0002', '_0002', '_0002', '_0002', '_0002'
Source: Imprimir_Entrada.exe, U6JDMvgrpZL.cs	High entropy of concatenated method names: '_7lI3JV3PvKL', 't7ErJESoE6mkyUHu', 'bbnLO7pU14XEPUK', 'xTPrzikHg9A8hEzNI7UtiKf9Y', '_0002', '_7rwxFK5S9bMnxQ', 'dRaN6LXgsDyUFfb2', 'fRBrjdFtog', 'BnXNmu9maSrCkLEuQzzxhi', 'HgOl3xUdSpteE'
Source: Imprimir_Entrada.exe, 59zCccc6RkaNHcedZArKTD8i7iMA.cs	High entropy of concatenated method names: '_0002', '_0003', '_0002', '_0002', '_0002', 'oKdCbrosEpTYFQEe5HEP', '_2jSt5ch5I4v2LLQgHarJSrnYJDKn', 'ZEGflwkKTg', 'Gx5uig4Fx7yqWG', 'K54k2R42szoWjZpWy4cDfv'
Source: Imprimir_Entrada.exe, 9lE4Ze0NsN.cs	High entropy of concatenated method names: '_0002', '_0002', '_0002', '_0003', 'uLE9OxVEraxuwVBQpytv1Xd', 'lrp5xQaCMot7tD', 'fGervoyBn04MFWdwWs1YhHZQa9vhI', 'Dhl1NpXpriwqBF3EUqs2WP', 'Dispose', 'pZYqNRv3Q2BxWkOIyYqASl0GUXV'
Source: Imprimir_Entrada.exe, VyGGhq7pUKxy5imdbM9RBG.cs	High entropy of concatenated method names: '_1qkP2ha6P8jpgOGDTYrS0IRM05', 'LNoTmPzsBRAVOsZlBPkeoZT', 'PwH7sZXY72Ptlp6ZrgE', 'TDcjbgP7QaBv3KD0H19m4lXWd', 'AVTKxHUiJMTigLJaHg0d0al', 'Szhc1rqGFvg', 'oGn3bVA1gjVxcde0fAzjuN17k2qc', 'NcupQwB37CfZtjtdtAXN', 'kF66JbOpSioiWTHkIMrc7i8UKA', 'Id11SOpmXytGUwNod01XQm'
Source: Imprimir_Entrada.exe, 8QdkSJ9LIchOq51wd.cs	High entropy of concatenated method names: 'Dispose', 'yRKTayrXKxVADreG', 'u2tDjojVWlUAJBvWSHqLo0', '_249L0IYztkTG3tQOnl7DMWW', 'wkovjy574O', 'IkctN8wla041mC3Cjrwbgh8ZPdn', '_4oVMo3HnK2tFau6', '_2sCspvVQHxUkm', 'duUgqverNt'
Source: Imprimir_Entrada.exe, KilG6AXpVy3dBSwGcdCN.cs	High entropy of concatenated method names: '_0002', 'cLKlscv7w7hC1AqVyxix9SF2', 'eXDAFp3DyrXbeNhmrj', 'WaKRFvopeatKFSLOEr7qRn8CST4', 'jAKRsOfAUF7Ob9Zn', 'hSJT9d5u3js', 'H8w1UGdQbb0wL39usOS', 'V6vBuAjhPhzowi', 'GLXG35WoGbWIGd', 'BoRdGLNuGUg6B'
Source: Imprimir_Entrada.exe, d1z8iwg2u7.cs	High entropy of concatenated method names: '_0002', 'nRmiJCYnHj3ymQJ3zQs9L', 'xW4FF7oEPzNrrBxmOCzwac', 'CNsY2qlB8YAdQoE7a9CTD', '_5iIFNCqJYLVw11WivYnyPS', 'hh8KEYxXJgbSKQwdjVyAzIe', 'Mk2OopPWn1kiO2lvlyLPajMS8', 'EcaS1YDM7dgitdRFpTqOOrtDYA6O', '_0002'
Source: Imprimir_Entrada.exe, zw7EnVIGFQPuk0Ue1ILxCybAC.cs	High entropy of concatenated method names: 'x65Q2ZDIroTXnOQAE4RPMP', 'jJ6KqtBV7C8hMKyX0rbIpLd', '_7hCugswbiPVG5OWZpTV', 'oqDzPgbiuGAXpbMI', 'RyOPh96ysclUCdW0JzReNfA'
Source: Imprimir_Entrada.exe, 7Fo6xojWB9.cs	High entropy of concatenated method names: 'OxRBXXOqDH', 'EGBiGrMdUAwVhrgvK', 'gzjpnUjt74FIRcCdsRtR21n4yAcbu', '_0lErgRxZcr9WtRYM', 'UTD9PC2GpMo1n2I9oDdDj5uq', 'yBSfIVgmQHIqUljL', '_1FIizy1XEN4IKYiXqbAkkh', 'IPWu9SUc427Ephu8MbIDHldGsk'

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File created: C:\Users\user\AppData\Local\Temp\LM6C8EYHXFcK.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	File created: C:\Users\user\AppData\Roaming\SubDir\Client.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	File opened: C:\Users\user\Desktop\Imprimir_Entrada.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Roaming\SubDir\Client.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Memory allocated: 11F6C5E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Memory allocated: 11F6E050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Memory allocated: 1D838140000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Memory allocated: 1D850310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Memory allocated: 26E98350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Memory allocated: 26EB1CC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Window / User API: threadDelayed 4531			Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Window / User API: threadDelayed 4757			Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\LM6C8EYHXFcK.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe TID: 6640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 7212	Thread sleep count: 86 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 7264	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 7268	Thread sleep count: 4531 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 7268	Thread sleep count: 4757 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 6608	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe TID: 7236	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Client.exe, 00000004.00000002.3698641246.000001D850C80000.00000004.00000020.00020000.00000000.sdmp, Client.exe, 00000004.00000002.3699365094.000001D850D72000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: netsh.exe, 0000000E.00000003.1350893174.000002B809565000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Process created: C:\Users\user\AppData\Roaming\SubDir\Client.exe "C:\Users\user\AppData\Roaming\SubDir\Client.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\schtasks.exe "schtasks" /create /tn "Photoshop Client Startup" /sc ONLOGON /tr "C:\Users\user\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe	Queries volume information: C:\Users\user\Desktop\Imprimir_Entrada.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Client.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Queries volume information: C:\Users\user\AppData\Roaming\SubDir\Client.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Imprimir_Entrada.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe

Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: Imprimir_Entrada.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Imprimir_Entrada.exe.11f6c190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1320232290.0000026E98206000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Imprimir_Entrada.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Client.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match

File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	Process created: C:\Windows\System32\netsh.exe "netsh" wlan show profiles			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Roaming\SubDir\Client.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: Imprimir_Entrada.exe, type: SAMPLE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Imprimir_Entrada.exe.11f6c7d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.Imprimir_Entrada.exe.11f6c190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1277368267.0000011F6EA82000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1276901567.0000011F6C7D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1275681330.0000011F6C3D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1320232290.0000026E98206000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1231929670.0000011F6C192000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Imprimir_Entrada.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Client.exe PID: 7188, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\SubDir\Client.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match

File source: Process Memory Space: Client.exe PID: 4212, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	23 System Information Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Create Account	11 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Query Registry	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	11 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	41 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	41 Virtualization/Sandbox Evasion	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Imprimir_Entrada.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Imprimir_Entrada.exe