Loading ...

Play interactive tourEdit tour

Analysis Report PO-A2174679-06.exe

Overview

General Information

Sample Name:PO-A2174679-06.exe
Analysis ID:356484
MD5:fdec289fb4626dd56bbb55770ae5f432
SHA1:1a1f324185e6114fb1362b00f27fe8009a202361
SHA256:eb53256b217e27a7ab0f71be2181599a79dc0569dea7fdbc5b32cf96a6bc9109
Tags:exe

Most interesting Screenshot:

Detection

GuLoader Lokibot
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected GuLoader
Yara detected Lokibot
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Contains functionality to hide a thread from the debugger
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Hides threads from debuggers
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • PO-A2174679-06.exe (PID: 6600 cmdline: 'C:\Users\user\Desktop\PO-A2174679-06.exe' MD5: FDEC289FB4626DD56BBB55770AE5F432)
    • PO-A2174679-06.exe (PID: 5424 cmdline: 'C:\Users\user\Desktop\PO-A2174679-06.exe' MD5: FDEC289FB4626DD56BBB55770AE5F432)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Lokibot_1Yara detected LokibotJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpJoeSecurity_GuLoaderYara detected GuLoaderJoe Security
      0000000B.00000002.501855027.0000000000A83000.00000004.00000020.sdmpJoeSecurity_Lokibot_1Yara detected LokibotJoe Security
        Process Memory Space: PO-A2174679-06.exe PID: 5424JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
          Process Memory Space: PO-A2174679-06.exe PID: 5424JoeSecurity_Lokibot_1Yara detected LokibotJoe Security
            Process Memory Space: PO-A2174679-06.exe PID: 5424JoeSecurity_GuLoaderYara detected GuLoaderJoe Security
              Click to see the 2 entries

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for submitted fileShow sources
              Source: PO-A2174679-06.exeVirustotal: Detection: 16%Perma Link

              Compliance:

              barindex
              Uses 32bit PE filesShow sources
              Source: PO-A2174679-06.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

              Networking:

              barindex
              Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
              Source: TrafficSnort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49732 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49732 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49732 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49732 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49733 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49733 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49733 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49733 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49734 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49734 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49734 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49734 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49735 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49735 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49735 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49735 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49736 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49736 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49736 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49736 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49737 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49737 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49737 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49737 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49738 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49738 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49738 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49738 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49739 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49739 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49739 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49739 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49740 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49740 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49740 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49740 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49741 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49741 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49741 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49741 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49743 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49743 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49743 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49743 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49744 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49744 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49744 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49744 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49745 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49745 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49745 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49745 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49746 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49746 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49746 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49746 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49747 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49747 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49747 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49747 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49748 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49748 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49748 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49748 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49749 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49749 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49749 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49749 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49750 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49750 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49750 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49750 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49751 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49751 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49751 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49751 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49752 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49752 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49752 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49752 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49753 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49753 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49753 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49753 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49755 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49755 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49755 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49755 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49759 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49759 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49759 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49759 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49761 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49761 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49761 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49761 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49763 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49763 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49763 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49763 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49765 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49765 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49765 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49765 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49766 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49766 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49766 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49766 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49767 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49767 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49767 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49767 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49768 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49768 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49768 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49768 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49769 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49769 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49769 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49769 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49770 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49770 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49770 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49770 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49771 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49771 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49771 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49771 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49772 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49772 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49772 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49772 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49773 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49773 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49773 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49773 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49774 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49774 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49774 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49774 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49775 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49775 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49775 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49775 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49776 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49776 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49776 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49776 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49777 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49777 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49777 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49777 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49778 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49778 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49778 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49778 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49779 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49779 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49779 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49779 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49780 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49780 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49780 -> 192.185.78.145:80
              Source: TrafficSnort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49780 -> 192.185.78.145:80
              Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: global trafficHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 165Connection: close
              Source: unknownDNS traffic detected: queries for: onedrive.live.com
              Source: unknownHTTP traffic detected: POST /ovation/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: accessasia.com.hkAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EB0DDECContent-Length: 192Connection: close
              Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 23 Feb 2021 07:49:25 GMTServer: ApacheUpgrade: h2,h2cConnection: Upgrade, closeContent-Length: 15Content-Type: text/htmlData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
              Source: PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmpString found in binary or memory: http://accessasia.com.hk/ovation/five/fre.php
              Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
              Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0:
              Source: PO-A2174679-06.exe, 0000000B.00000003.460675918.0000000000AAE000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.msocsp.com0
              Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpString found in binary or memory: http://sinatrasmob.com/pro/ovation_byHOXsph232.bin
              Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpString found in binary or memory: https://cdn.discordapp.com/attachments/813514912135380996/813514973141532722/ovation_byHOXsph232.bin
              Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmpString found in binary or memory: https://hrf0ga.bn.files.1drv.com/
              Source: PO-A2174679-06.exe, 0000000B.00000002.501855027.0000000000A83000.00000004.00000020.sdmp, PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmpString found in binary or memory: https://hrf0ga.bn.files.1drv.com/y4m5zM3NcSoKRZxp1cr4njUjeP9hX2vmu4HSL4nnw0taslILmJBULwQ1DfMXTHzg-Rs
              Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmpString found in binary or memory: https://onedrive.live.com/
              Source: PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpString found in binary or memory: https://onedrive.live.com/download?cid=B1076D30E2A6430F&resid=B1076D30E2A6430F%21110&authkey=AO3GCQa
              Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmpString found in binary or memory: https://onedrive.live.com/n
              Source: PO-A2174679-06.exe, 00000000.00000002.346109535.000000000073A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess Stats: CPU usage > 98%
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC0699 EnumWindows,NtSetInformationThread,0_2_02BC0699
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC4291 NtSetInformationThread,LdrInitializeThunk,0_2_02BC4291
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC81F3 NtResumeThread,0_2_02BC81F3
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC7B36 NtProtectVirtualMemory,0_2_02BC7B36
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC570F NtSetInformationThread,0_2_02BC570F
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC0977 NtWriteVirtualMemory,TerminateProcess,LdrInitializeThunk,LoadLibraryA,0_2_02BC0977
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC6F5E NtWriteVirtualMemory,0_2_02BC6F5E
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC1AB6 NtSetInformationThread,0_2_02BC1AB6
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC829E NtResumeThread,0_2_02BC829E
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC72EF NtWriteVirtualMemory,0_2_02BC72EF
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC84C5 NtResumeThread,0_2_02BC84C5
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC083A NtSetInformationThread,0_2_02BC083A
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC1A7F NtSetInformationThread,0_2_02BC1A7F
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC446A NtSetInformationThread,NtWriteVirtualMemory,0_2_02BC446A
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC8664 NtWriteVirtualMemory,0_2_02BC8664
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC2DFD NtWriteVirtualMemory,0_2_02BC2DFD
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC6D2D NtSetInformationThread,0_2_02BC6D2D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3105 NtWriteVirtualMemory,0_2_02BC3105
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC6F06 NtWriteVirtualMemory,0_2_02BC6F06
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC4307 NtSetInformationThread,NtWriteVirtualMemory,LdrInitializeThunk,0_2_02BC4307
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC077C NtSetInformationThread,0_2_02BC077C
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC2F6F NtWriteVirtualMemory,0_2_02BC2F6F
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC8554 NtResumeThread,0_2_02BC8554
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC8150 NtResumeThread,0_2_02BC8150
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC09770_2_02BC0977
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB216511_3_00AB2165
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB084D11_3_00AB084D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB794D11_3_00AB794D
              Source: PO-A2174679-06.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: PO-A2174679-06.exe, 00000000.00000002.346228693.00000000021F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exe, 00000000.00000000.231740123.0000000000414000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exe, 0000000B.00000002.502209088.0000000002440000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exe, 0000000B.00000000.344741544.0000000000414000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exe, 0000000B.00000002.502225382.0000000002490000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exeBinary or memory string: OriginalFilenameyappingextr.exe vs PO-A2174679-06.exe
              Source: PO-A2174679-06.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/2@43/1
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\CryptoJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeMutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile created: C:\Users\user\AppData\Local\Temp\~DF584B63FBA4AD36AE.TMPJump to behavior
              Source: PO-A2174679-06.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: PO-A2174679-06.exeVirustotal: Detection: 16%
              Source: unknownProcess created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe'
              Source: unknownProcess created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe'
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess created: C:\Users\user\Desktop\PO-A2174679-06.exe 'C:\Users\user\Desktop\PO-A2174679-06.exe' Jump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\OutlookJump to behavior

              Data Obfuscation:

              barindex
              Yara detected GuLoaderShow sources
              Source: Yara matchFile source: 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: PO-A2174679-06.exe PID: 6600, type: MEMORY
              Yara detected VB6 Downloader GenericShow sources
              Source: Yara matchFile source: Process Memory Space: PO-A2174679-06.exe PID: 5424, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: PO-A2174679-06.exe PID: 6600, type: MEMORY
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_0040DAC0 push dword ptr [ebp-14h]; ret 0_2_0041096D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_00404856 push edi; retf 0_2_00404857
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_00406411 push edx; ret 0_2_00406412
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_004030D6 pushfd ; retf 0_2_004030DD
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_00403096 pushfd ; retf 0_2_0040309D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3C9F pushad ; retf 0_2_02BC3CA2
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3AE6 pushad ; retf 0_2_02BC3AE9
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3AC2 pushad ; retf 0_2_02BC3AC3
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3C38 pushad ; retf 0_2_02BC3C3B
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3C14 pushad ; retf 0_2_02BC3C15
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC5015 pushfd ; retf 0_2_02BC5016
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3A02 pushad ; retf 0_2_02BC3A05
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3C7B pushad ; retf 0_2_02BC3C7C
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3A76 pushad ; retf 0_2_02BC3A79
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3A52 pushad ; retf 0_2_02BC3A53
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3B9F pushad ; retf 0_2_02BC3BA0
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC39DE pushad ; retf 0_2_02BC39DF
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3BC3 pushad ; retf 0_2_02BC3BC6
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3B2B pushad ; retf 0_2_02BC3B2D
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC3B50 pushad ; retf 0_2_02BC3B53
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 11_3_00AB818D push ss; ret 11_3_00AB8192
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeProcess information set: NOGPFAULTERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC6F5E NtWriteVirtualMemory,0_2_02BC6F5E
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC6F06 NtWriteVirtualMemory,0_2_02BC6F06
              Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC70A5 second address: 0000000002BC70A5 instructions:
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC7263 second address: 0000000002BC7263 instructions:
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC6D02 second address: 0000000002BC6D02 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0FBC787E78h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp dx, bx 0x00000020 add edi, edx 0x00000022 cmp ax, cx 0x00000025 dec dword ptr [ebp+000000F8h] 0x0000002b cmp dword ptr [ebp+000000F8h], 00000000h 0x00000032 jne 00007F0FBC787E55h 0x00000034 nop 0x00000035 call 00007F0FBC787EAAh 0x0000003a call 00007F0FBC787E88h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
              Tries to detect Any.runShow sources
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile opened: C:\Program Files\Qemu-ga\qemu-ga.exeJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeFile opened: C:\Program Files\qga\qga.exeJump to behavior
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: PO-A2174679-06.exe, PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC70A5 second address: 0000000002BC70A5 instructions:
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC7263 second address: 0000000002BC7263 instructions:
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC6D02 second address: 0000000002BC6D02 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F0FBC787E78h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp dx, bx 0x00000020 add edi, edx 0x00000022 cmp ax, cx 0x00000025 dec dword ptr [ebp+000000F8h] 0x0000002b cmp dword ptr [ebp+000000F8h], 00000000h 0x00000032 jne 00007F0FBC787E55h 0x00000034 nop 0x00000035 call 00007F0FBC787EAAh 0x0000003a call 00007F0FBC787E88h 0x0000003f lfence 0x00000042 mov edx, dword ptr [7FFE0014h] 0x00000048 lfence 0x0000004b ret 0x0000004c mov esi, edx 0x0000004e pushad 0x0000004f rdtsc
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000002BC6D22 second address: 0000000002BC6D22 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0FBC870ADEh 0x0000001d popad 0x0000001e call 00007F0FBC87053Ah 0x00000023 lfence 0x00000026 rdtsc
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeRDTSC instruction interceptor: First address: 0000000000566D22 second address: 0000000000566D22 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F0FBC78853Eh 0x0000001d popad 0x0000001e call 00007F0FBC787F9Ah 0x00000023 lfence 0x00000026 rdtsc
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeCode function: 0_2_02BC0977 rdtsc 0_2_02BC0977
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeWindow / User API: threadDelayed 1628Jump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 6576Thread sleep count: 1628 > 30Jump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 4504Thread sleep time: -120000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exe TID: 4504Thread sleep time: -60000s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\PO-A2174679-06.exeThread sleep count: Count: 1628 delay: -5Jump to behavior
              Source: PO-A2174679-06.exe, 0000000B.00000002.501778520.0000000000A67000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAWayer LightWeight Filter-0000
              Source: PO-A2174679-06.exe, 0000000B.00000002.501746377.0000000000A27000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
              Source: PO-A2174679-06.exe, PO-A2174679-06.exe, 0000000B.00000002.501095690.0000000000562000.00000040.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

              Anti Debugging:

              barindex