Loading ...

Play interactive tourEdit tour

Analysis Report kj9Xrb81w4

Overview

General Information

Sample Name:kj9Xrb81w4 (renamed file extension from none to exe)
Analysis ID:317916
MD5:172817a62cbabbf9523d783346369ae8
SHA1:be4d9d258d2bbddacebebdd4d004507ee02da62c
SHA256:c097474f5af68187b791c8daca47f6f0747773b2465e0b2f231be9980f9a96a3
Tags:Gozi

Most interesting Screenshot:

Detection

Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Creates a COM Internet Explorer object
Machine Learning detection for sample
Writes or reads registry keys via WMI
Writes registry values via WMI
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Detected potential crypto function
Found potential string decryption / allocating functions
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • kj9Xrb81w4.exe (PID: 6952 cmdline: 'C:\Users\user\Desktop\kj9Xrb81w4.exe' MD5: 172817A62CBABBF9523D783346369AE8)
  • iexplore.exe (PID: 5924 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 4876 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5924 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"server": "12", "version": "214062", "uptime": "193a", "crc": "1", "id": "3186", "user": "dcce1ea43156457cdc8b6ef56ec4b294", "soft": "3"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
        00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
          00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
            Click to see the 5 entries

            Sigma Overview

            No Sigma rule has matched

            Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Found malware configurationShow sources
            Source: kj9Xrb81w4.exe.6952.0.memstrMalware Configuration Extractor: Ursnif {"server": "12", "version": "214062", "uptime": "193a", "crc": "1", "id": "3186", "user": "dcce1ea43156457cdc8b6ef56ec4b294", "soft": "3"}
            Source: kj9Xrb81w4.exe.6952.0.memstrMalware Configuration Extractor: Ursnif {"server": "12", "version": "214062", "uptime": "193a", "crc": "1", "id": "3186", "user": "dcce1ea43156457cdc8b6ef56ec4b294", "soft": "3"}
            Multi AV Scanner detection for domain / URLShow sources
            Source: qrodericky94.companyVirustotal: Detection: 7%Perma Link
            Source: qrodericky94.companyVirustotal: Detection: 7%Perma Link
            Source: http://qrodericky94.company/favicon.icoVirustotal: Detection: 10%Perma Link
            Multi AV Scanner detection for submitted fileShow sources
            Source: kj9Xrb81w4.exeVirustotal: Detection: 56%Perma Link
            Source: kj9Xrb81w4.exeMetadefender: Detection: 21%Perma Link
            Source: kj9Xrb81w4.exeReversingLabs: Detection: 31%
            Source: kj9Xrb81w4.exeVirustotal: Detection: 56%Perma Link
            Source: kj9Xrb81w4.exeMetadefender: Detection: 21%Perma Link
            Source: kj9Xrb81w4.exeReversingLabs: Detection: 31%
            Machine Learning detection for sampleShow sources
            Source: kj9Xrb81w4.exeJoe Sandbox ML: detected
            Source: kj9Xrb81w4.exeJoe Sandbox ML: detected
            Source: 0.2.kj9Xrb81w4.exe.e50000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen7
            Source: 0.2.kj9Xrb81w4.exe.e50000.0.unpackAvira: Label: TR/Crypt.XPACK.Gen7

            Networking:

            barindex
            Creates a COM Internet Explorer objectShow sources
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAsJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerJump to behavior
            Source: global trafficHTTP traffic detected: GET /images/wrgxWqS2B_2FXAZ/RkKR70xQvdnxfJUmvC/TVUYhY2DO/WLbUcyMI_2FTThfQYEE_/2BU78gNdVVuZcWEXbDV/7hthk5MC6mP6vxNtj6FzRJ/USWFcWCUhvAUo/P0kLxjxz/qeKOJy9fyAy57zpUs1fQrXw/iDvqKkF7/K.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: qrodericky94.companyConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: qrodericky94.companyConnection: Keep-AliveCookie: btst=d7b5a488f6bae894f8bb265684fa1449|84.17.52.40|1605528400|1605528400|0|1|0; snkz=84.17.52.40
            Source: global trafficHTTP traffic detected: GET /images/wrgxWqS2B_2FXAZ/RkKR70xQvdnxfJUmvC/TVUYhY2DO/WLbUcyMI_2FTThfQYEE_/2BU78gNdVVuZcWEXbDV/7hthk5MC6mP6vxNtj6FzRJ/USWFcWCUhvAUo/P0kLxjxz/qeKOJy9fyAy57zpUs1fQrXw/iDvqKkF7/K.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: qrodericky94.companyConnection: Keep-Alive
            Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: qrodericky94.companyConnection: Keep-AliveCookie: btst=d7b5a488f6bae894f8bb265684fa1449|84.17.52.40|1605528400|1605528400|0|1|0; snkz=84.17.52.40
            Source: msapplication.xml0.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x72fb35f8,0x01d6bc5c</date><accdate>0x72fb35f8,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
            Source: msapplication.xml0.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x72fb35f8,0x01d6bc5c</date><accdate>0x72fb35f8,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
            Source: msapplication.xml5.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x730721ee,0x01d6bc5c</date><accdate>0x730721ee,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
            Source: msapplication.xml5.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x730721ee,0x01d6bc5c</date><accdate>0x730721ee,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
            Source: msapplication.xml7.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x733b9527,0x01d6bc5c</date><accdate>0x733b9527,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
            Source: msapplication.xml7.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x733b9527,0x01d6bc5c</date><accdate>0x733b9527,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
            Source: msapplication.xml0.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x72fb35f8,0x01d6bc5c</date><accdate>0x72fb35f8,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
            Source: msapplication.xml0.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x72fb35f8,0x01d6bc5c</date><accdate>0x72fb35f8,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
            Source: msapplication.xml5.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x730721ee,0x01d6bc5c</date><accdate>0x730721ee,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
            Source: msapplication.xml5.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x730721ee,0x01d6bc5c</date><accdate>0x730721ee,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
            Source: msapplication.xml7.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x733b9527,0x01d6bc5c</date><accdate>0x733b9527,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
            Source: msapplication.xml7.6.drString found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x733b9527,0x01d6bc5c</date><accdate>0x733b9527,0x01d6bc5c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
            Source: unknownDNS traffic detected: queries for: qrodericky94.company
            Source: unknownDNS traffic detected: queries for: qrodericky94.company
            Source: {9CA8EEE9-284F-11EB-90E5-ECF4BB2D2496}.dat.6.drString found in binary or memory: http://qrodericky94.company/images/wrgxWqS2B_2FXAZ/RkKR70xQvdnxfJUmvC/TVUYhY2DO/WLbUcyMI_2FTThfQYEE_
            Source: msapplication.xml.6.drString found in binary or memory: http://www.amazon.com/
            Source: msapplication.xml1.6.drString found in binary or memory: http://www.google.com/
            Source: msapplication.xml2.6.drString found in binary or memory: http://www.live.com/
            Source: msapplication.xml3.6.drString found in binary or memory: http://www.nytimes.com/
            Source: msapplication.xml4.6.drString found in binary or memory: http://www.reddit.com/
            Source: msapplication.xml5.6.drString found in binary or memory: http://www.twitter.com/
            Source: msapplication.xml6.6.drString found in binary or memory: http://www.wikipedia.com/
            Source: msapplication.xml7.6.drString found in binary or memory: http://www.youtube.com/
            Source: {9CA8EEE9-284F-11EB-90E5-ECF4BB2D2496}.dat.6.drString found in binary or memory: http://qrodericky94.company/images/wrgxWqS2B_2FXAZ/RkKR70xQvdnxfJUmvC/TVUYhY2DO/WLbUcyMI_2FTThfQYEE_
            Source: msapplication.xml.6.drString found in binary or memory: http://www.amazon.com/
            Source: msapplication.xml1.6.drString found in binary or memory: http://www.google.com/
            Source: msapplication.xml2.6.drString found in binary or memory: http://www.live.com/
            Source: msapplication.xml3.6.drString found in binary or memory: http://www.nytimes.com/
            Source: msapplication.xml4.6.drString found in binary or memory: http://www.reddit.com/
            Source: msapplication.xml5.6.drString found in binary or memory: http://www.twitter.com/
            Source: msapplication.xml6.6.drString found in binary or memory: http://www.wikipedia.com/
            Source: msapplication.xml7.6.drString found in binary or memory: http://www.youtube.com/

            Key, Mouse, Clipboard, Microphone and Screen Capturing:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413868067.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.428037689.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413951156.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413921027.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: kj9Xrb81w4.exe PID: 6952, type: MEMORY

            E-Banking Fraud:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413868067.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.428037689.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413951156.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413921027.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: kj9Xrb81w4.exe PID: 6952, type: MEMORY

            System Summary:

            barindex
            Writes or reads registry keys via WMIShow sources
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Writes registry values via WMIShow sources
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E52DE2 NtCreateSection,memset,RtlNtStatusToDosError,ZwClose,0_2_00E52DE2
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5234A memset,memcpy,NtSetContextThread,LdrInitializeThunk,RtlNtStatusToDosError,GetLastError,0_2_00E5234A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5165C NtMapViewOfSection,RtlNtStatusToDosError,0_2_00E5165C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5195A LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,LdrInitializeThunk,GetModuleHandleA,LdrInitializeThunk,memcpy,0_2_00E5195A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51F96 memcpy,memcpy,memcpy,NtUnmapViewOfSection,RtlNtStatusToDosError,FindCloseChangeNotification,memset,0_2_00E51F96
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5261E GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,NtGetContextThread,NtGetContextThread,LdrInitializeThunk,0_2_00E5261E
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E531E0 NtGetContextThread,0_2_00E531E0
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5344D NtQueryVirtualMemory,0_2_00E5344D
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51CDD NtGetContextThread,LdrInitializeThunk,RtlNtStatusToDosError,0_2_00E51CDD
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51EDF NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,0_2_00E51EDF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5133C NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,0_2_00E5133C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF57C7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,0_2_00DF57C7
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E89970 NtdllDefWindowProc_A,CallWindowProcA,0_2_00E89970
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E8BB45 NtdllDefWindowProc_A,0_2_00E8BB45
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E52DE2 NtCreateSection,memset,RtlNtStatusToDosError,ZwClose,0_2_00E52DE2
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5234A memset,memcpy,NtSetContextThread,LdrInitializeThunk,RtlNtStatusToDosError,GetLastError,0_2_00E5234A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5165C NtMapViewOfSection,RtlNtStatusToDosError,0_2_00E5165C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5195A LdrLoadDll,LdrGetProcedureAddress,NtProtectVirtualMemory,LdrInitializeThunk,GetModuleHandleA,LdrInitializeThunk,memcpy,0_2_00E5195A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51F96 memcpy,memcpy,memcpy,NtUnmapViewOfSection,RtlNtStatusToDosError,FindCloseChangeNotification,memset,0_2_00E51F96
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5261E GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,NtGetContextThread,NtGetContextThread,LdrInitializeThunk,0_2_00E5261E
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E531E0 NtGetContextThread,0_2_00E531E0
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5344D NtQueryVirtualMemory,0_2_00E5344D
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51CDD NtGetContextThread,LdrInitializeThunk,RtlNtStatusToDosError,0_2_00E51CDD
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51EDF NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError,0_2_00E51EDF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5133C NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError,0_2_00E5133C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF57C7 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,0_2_00DF57C7
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E89970 NtdllDefWindowProc_A,CallWindowProcA,0_2_00E89970
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E8BB45 NtdllDefWindowProc_A,0_2_00E8BB45
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5322C0_2_00E5322C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF93CC0_2_00DF93CC
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF5E3B0_2_00DF5E3B
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EA389C0_2_00EA389C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E9F6980_2_00E9F698
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E96E3C0_2_00E96E3C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E99E060_2_00E99E06
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E91F320_2_00E91F32
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5322C0_2_00E5322C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF93CC0_2_00DF93CC
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF5E3B0_2_00DF5E3B
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EA389C0_2_00EA389C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E9F6980_2_00E9F698
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E96E3C0_2_00E96E3C
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E99E060_2_00E99E06
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E91F320_2_00E91F32
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: String function: 00E919E0 appears 43 times
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: String function: 00E919E0 appears 43 times
            Source: kj9Xrb81w4.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: kj9Xrb81w4.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
            Source: kj9Xrb81w4.exe, 00000000.00000002.427015631.0000000000EC0000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameEnoughthis.exe2 vs kj9Xrb81w4.exe
            Source: kj9Xrb81w4.exeBinary or memory string: OriginalFilenameEnoughthis.exe2 vs kj9Xrb81w4.exe
            Source: kj9Xrb81w4.exe, 00000000.00000002.427015631.0000000000EC0000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameEnoughthis.exe2 vs kj9Xrb81w4.exe
            Source: kj9Xrb81w4.exeBinary or memory string: OriginalFilenameEnoughthis.exe2 vs kj9Xrb81w4.exe
            Source: kj9Xrb81w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: kj9Xrb81w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: classification engineClassification label: mal100.bank.troj.evad.winEXE@4/14@1/1
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E863A4 LoadResource,LockResource,SizeofResource,0_2_00E863A4
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E863A4 LoadResource,LockResource,SizeofResource,0_2_00E863A4
            Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9CA8EEE7-284F-11EB-90E5-ECF4BB2D2496}.datJump to behavior
            Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9CA8EEE7-284F-11EB-90E5-ECF4BB2D2496}.datJump to behavior
            Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DF3DDE10A1CC16068A.TMPJump to behavior
            Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DF3DDE10A1CC16068A.TMPJump to behavior
            Source: kj9Xrb81w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: kj9Xrb81w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Program Files\internet explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Program Files\internet explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: kj9Xrb81w4.exeVirustotal: Detection: 56%
            Source: kj9Xrb81w4.exeMetadefender: Detection: 21%
            Source: kj9Xrb81w4.exeReversingLabs: Detection: 31%
            Source: kj9Xrb81w4.exeVirustotal: Detection: 56%
            Source: kj9Xrb81w4.exeMetadefender: Detection: 21%
            Source: kj9Xrb81w4.exeReversingLabs: Detection: 31%
            Source: unknownProcess created: C:\Users\user\Desktop\kj9Xrb81w4.exe 'C:\Users\user\Desktop\kj9Xrb81w4.exe'
            Source: unknownProcess created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
            Source: unknownProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5924 CREDAT:17410 /prefetch:2
            Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5924 CREDAT:17410 /prefetch:2Jump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\kj9Xrb81w4.exe 'C:\Users\user\Desktop\kj9Xrb81w4.exe'
            Source: unknownProcess created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
            Source: unknownProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5924 CREDAT:17410 /prefetch:2
            Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5924 CREDAT:17410 /prefetch:2Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior
            Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: kj9Xrb81w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: c:\electric\solution\Student\problem\pushsense.pdb\ source: kj9Xrb81w4.exe
            Source: Binary string: c:\electric\solution\Student\problem\pushsense.pdb source: kj9Xrb81w4.exe
            Source: Binary string: c:\electric\solution\Student\problem\pushsense.pdb\ source: kj9Xrb81w4.exe
            Source: Binary string: c:\electric\solution\Student\problem\pushsense.pdb source: kj9Xrb81w4.exe
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: kj9Xrb81w4.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

            Data Obfuscation:

            barindex
            Detected unpacking (changes PE section rights)Show sources
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeUnpacked PE file: 0.2.kj9Xrb81w4.exe.e50000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeUnpacked PE file: 0.2.kj9Xrb81w4.exe.e50000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
            Detected unpacking (overwrites its own PE header)Show sources
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeUnpacked PE file: 0.2.kj9Xrb81w4.exe.e50000.0.unpack
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeUnpacked PE file: 0.2.kj9Xrb81w4.exe.e50000.0.unpack
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5321B push ecx; ret 0_2_00E5322B
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF93BB push ecx; ret 0_2_00DF93CB
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E618A0 push esp; retf 0_2_00E618A1
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E61198 push cs; ret 0_2_00E611C2
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E91A25 push ecx; ret 0_2_00E91A38
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E603AB push es; retf 0_2_00E603FF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90347 push ecx; ret 0_2_00E9035A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E63DE9 push eax; ret 0_2_00E63DF7
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E5321B push ecx; ret 0_2_00E5322B
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF93BB push ecx; ret 0_2_00DF93CB
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E618A0 push esp; retf 0_2_00E618A1
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E61198 push cs; ret 0_2_00E611C2
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E91A25 push ecx; ret 0_2_00E91A38
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E603AB push es; retf 0_2_00E603FF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90347 push ecx; ret 0_2_00E9035A
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E63DE9 push eax; ret 0_2_00E63DF7

            Hooking and other Techniques for Hiding and Protection:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413868067.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.428037689.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413951156.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413921027.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: kj9Xrb81w4.exe PID: 6952, type: MEMORY
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E891CD IsIconic,GetWindowPlacement,GetWindowRect,0_2_00E891CD
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E891CD IsIconic,GetWindowPlacement,GetWindowRect,0_2_00E891CD
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51168 LdrInitializeThunk,lstrcmpA,lstrlenA,0_2_00E51168
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51168 LdrInitializeThunk,lstrcmpA,lstrlenA,0_2_00E51168
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90260 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E90260
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90260 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E90260
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EAF802 mov eax, dword ptr fs:[00000030h]0_2_00EAF802
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EAF3D4 push dword ptr fs:[00000030h]0_2_00EAF3D4
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EAF802 mov eax, dword ptr fs:[00000030h]0_2_00EAF802
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00EAF3D4 push dword ptr fs:[00000030h]0_2_00EAF3D4
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E512CF InitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,0_2_00E512CF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF1000 RtlInitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,0_2_00DF1000
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90260 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E90260
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E95D97 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E95D97
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E9A612 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00E9A612
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E512CF InitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,0_2_00E512CF
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF1000 RtlInitializeCriticalSection,TlsAlloc,RtlAddVectoredExceptionHandler,GetLastError,0_2_00DF1000
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E90260 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E90260
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E95D97 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00E95D97
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E9A612 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00E9A612
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF4BBE cpuid 0_2_00DF4BBE
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF4BBE cpuid 0_2_00DF4BBE
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: GetLocaleInfoA,0_2_00EA354F
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: GetLocaleInfoA,0_2_00EA354F
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF2BE6 GetSystemTimeAsFileTime,HeapFree,0_2_00DF2BE6
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF2BE6 GetSystemTimeAsFileTime,HeapFree,0_2_00DF2BE6
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF4BBE GetUserNameW,RtlAllocateHeap,HeapFree,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,0_2_00DF4BBE
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00DF4BBE GetUserNameW,RtlAllocateHeap,HeapFree,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,0_2_00DF4BBE
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51C69 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,0_2_00E51C69
            Source: C:\Users\user\Desktop\kj9Xrb81w4.exeCode function: 0_2_00E51C69 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,0_2_00E51C69

            Stealing of Sensitive Information:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413868067.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.428037689.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413951156.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413921027.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: kj9Xrb81w4.exe PID: 6952, type: MEMORY

            Remote Access Functionality:

            barindex
            Yara detected UrsnifShow sources
            Source: Yara matchFile source: 00000000.00000003.413969088.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413834890.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413895344.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413993813.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413983216.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413868067.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000002.428037689.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413951156.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.413921027.0000000003708000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: kj9Xrb81w4.exe PID: 6952, type: MEMORY

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Valid AccountsWindows Management Instrumentation2Path InterceptionProcess Injection1Masquerading1OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemorySecurity Software Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Deobfuscate/Decode Files or Information1Security Account ManagerApplication Window Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information2NTDSAccount Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware Packing22LSA SecretsSystem Owner/User Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsFile and Directory Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Information Discovery23Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.