Analysis Report NKPhba0VZI.exe

Overview

General Information

Sample Name:	NKPhba0VZI.exe
Analysis ID:	358333
MD5:	3a89cf2d6d2449ef1a9640af29f3a782
SHA1:	220b9c5b4c7e9de15753f629da1ac3a075dc0800
SHA256:	3d652eb897291f8eb2fe8f9374007388b0cd426a797de77545b82a325dde762a
Tags:	AgentTeslaexe
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Bypasses PowerShell execution policy

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Powershell drops PE file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Antivirus or Machine Learning detection for unpacked file

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: 10.2.Drivers.exe.3ca23b8.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "FTP Info": "th3books@nobettwo.xyzK]Za#W.$sattnobettwo.xyz"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: NKPhba0VZI.exe

ReversingLabs: Detection: 26%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NKPhba0VZI.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 20.2.Drivers.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 5.2.NKPhba0VZI.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8

Compliance:

Uses 32bit PE files

Source: NKPhba0VZI.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: NKPhba0VZI.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:

Binary string: RunPE.pdb source: NKPhba0VZI.exe, 00000001.00000002.209196388.0000000003051000.00000004.00000001.sdmp, Drivers.exe, 0000000A.00000002.296374394.0000000002B68000.00000004.00000001.sdmp

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49737 -> 198.54.126.101:587

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.3:49737 -> 198.54.126.101:587

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Uses SMTP (mail sending)

Source: global traffic

TCP traffic: 192.168.2.3:49737 -> 198.54.126.101:587

Source: unknown

DNS traffic detected: queries for: nobettwo.xyz

Source: NKPhba0VZI.exe, 00000005.00000002.474695925.0000000002C41000.00000004.00000001.sdmp, Drivers.exe, 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Drivers.exe, 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: NKPhba0VZI.exe, 00000001.00000002.209833769.0000000004059000.00000004.00000001.sdmp, Drivers.exe, 0000000A.00000002.296957145.0000000003B39000.00000004.00000001.sdmp	String found in binary or memory: http://blog.naver.com/cubemit314Ghttp://projectofsonagi.tistory.com/
Source: powershell.exe, 00000002.00000002.277720910.00000000076B0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.microsoft.co
Source: NKPhba0VZI.exe, 00000005.00000002.478647044.0000000002F04000.00000004.00000001.sdmp	String found in binary or memory: http://nobettwo.xyz
Source: powershell.exe, 00000002.00000002.272085164.0000000005593000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.376382490.0000000005CE5000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Drivers.exe, 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: http://oVNzXy.com
Source: powershell.exe, 00000002.00000003.262043012.00000000076F3000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.268161623.0000000004674000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.379255389.0000000007E33000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.372155180.0000000004DC3000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.267966815.0000000004531000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.371748819.0000000004C81000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000003.262043012.00000000076F3000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.268161623.0000000004674000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.379255389.0000000007E33000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.372155180.0000000004DC3000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: NKPhba0VZI.exe, 00000005.00000002.474695925.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: Drivers.exe, 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: powershell.exe, 0000000F.00000002.376382490.0000000005CE5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.376382490.0000000005CE5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.376382490.0000000005CE5000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000003.262043012.00000000076F3000.00000004.00000001.sdmp, powershell.exe, 00000002.00000002.268161623.0000000004674000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.379255389.0000000007E33000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.372155180.0000000004DC3000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.272085164.0000000005593000.00000004.00000001.sdmp, powershell.exe, 0000000F.00000002.376382490.0000000005CE5000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: NKPhba0VZI.exe, 00000005.00000002.474695925.0000000002C41000.00000004.00000001.sdmp	String found in binary or memory: https://pNaYvIZ26OfWPs.net
Source: NKPhba0VZI.exe, 00000001.00000003.199780118.0000000001408000.00000004.00000001.sdmp, NKPhba0VZI.exe, 00000005.00000002.463182723.0000000000402000.00000040.00000001.sdmp, Drivers.exe, 0000000A.00000002.296957145.0000000003B39000.00000004.00000001.sdmp, Drivers.exe, 00000014.00000002.463217997.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: NKPhba0VZI.exe, 00000005.00000002.474695925.0000000002C41000.00000004.00000001.sdmp, Drivers.exe, 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: NKPhba0VZI.exe, 00000001.00000002.208702303.000000000136A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe

Jump to dropped file

Detected potential crypto function

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 1_2_01686C71	1_2_01686C71
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 1_2_01684FA0	1_2_01684FA0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 1_2_0168B980	1_2_0168B980
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 1_2_0168B990	1_2_0168B990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07547EA0	2_2_07547EA0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07547EA0	2_2_07547EA0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D07880	5_2_00D07880
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D05010	5_2_00D05010
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D05E40	5_2_00D05E40
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D09F3A	5_2_00D09F3A
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D031E0	5_2_00D031E0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D00460	5_2_00D00460
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D1D578	5_2_00D1D578
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D1317E	5_2_00D1317E
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D1EA08	5_2_00D1EA08
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D11FE0	5_2_00D11FE0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D12768	5_2_00D12768
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D1BAB0	5_2_00D1BAB0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011D5840	5_2_011D5840
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011DBAC8	5_2_011DBAC8
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011D6F60	5_2_011D6F60
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011F35C8	5_2_011F35C8
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011F0040	5_2_011F0040
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011F4355	5_2_011F4355
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011F7A40	5_2_011F7A40
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011FAD00	5_2_011FAD00
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011FED38	5_2_011FED38
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011FADE1	5_2_011FADE1
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_011F0E68	5_2_011F0E68
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_05134772	5_2_05134772
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_05133EA8	5_2_05133EA8
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_05134827	5_2_05134827
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_05133D4F	5_2_05133D4F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 10_2_02A74FB0	10_2_02A74FB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 10_2_02A76C80	10_2_02A76C80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 10_2_02A7B980	10_2_02A7B980
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 10_2_02A7B990	10_2_02A7B990
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04C6D138	15_2_04C6D138
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04C6D1C3	15_2_04C6D1C3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07F04AB8	15_2_07F04AB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07F0AF18	15_2_07F0AF18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07F0AF07	15_2_07F0AF07
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_07F04AA9	15_2_07F04AA9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08049AD8	15_2_08049AD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_080450C8	15_2_080450C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0804C4A0	15_2_0804C4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0804AAD8	15_2_0804AAD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08046B30	15_2_08046B30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_080450BA	15_2_080450BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_0804C4A0	15_2_0804C4A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08078AD0	15_2_08078AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08078AD0	15_2_08078AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08070006	15_2_08070006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_08070040	15_2_08070040
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA4750	20_2_02CA4750
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA3D2C	20_2_02CA3D2C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA81B9	20_2_02CA81B9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA4827	20_2_02CA4827
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA54D2	20_2_02CA54D2
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_02CA3D20	20_2_02CA3D20

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe 3D652EB897291F8EB2FE8F9374007388B0CD426A797DE77545B82A325DDE762A

PE file contains strange resources

Source: NKPhba0VZI.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: Drivers.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: NKPhba0VZI.exe, 00000001.00000002.209196388.0000000003051000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPE.dll" vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000001.00000002.209196388.0000000003051000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameaGqFPgvIPMrNBrNVKGPQ.exe4 vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000001.00000002.209833769.0000000004059000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCaptIt.dll. vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000001.00000000.198462500.0000000000D53000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenpp.7.8.8.Installer.x64.exe4 vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000001.00000002.208702303.000000000136A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000005.00000002.472734152.0000000001030000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000005.00000002.465383827.0000000000883000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenpp.7.8.8.Installer.x64.exe4 vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000005.00000002.466697748.0000000000CF8000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000005.00000002.463182723.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameaGqFPgvIPMrNBrNVKGPQ.exe4 vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe, 00000005.00000002.467855777.0000000000D70000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs NKPhba0VZI.exe
Source: NKPhba0VZI.exe	Binary or memory string: OriginalFilenamenpp.7.8.8.Installer.x64.exe4 vs NKPhba0VZI.exe

Uses 32bit PE files

Source: NKPhba0VZI.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: NKPhba0VZI.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Drivers.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 1.0.NKPhba0VZI.exe.cd0000.0.unpack, pptfile.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.NKPhba0VZI.exe.cd0000.0.unpack, pptfile.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: Drivers.exe.2.dr, pptfile.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 5.2.NKPhba0VZI.exe.800000.1.unpack, pptfile.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@12/12@2/1

Source: C:\Users\user\Desktop\NKPhba0VZI.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NKPhba0VZI.exe.log

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5928:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6792:120:WilError_01

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NKPhba0VZI.exe 'C:\Users\user\Desktop\NKPhba0VZI.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\NKPhba0VZI.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\NKPhba0VZI.exe C:\Users\user\Desktop\NKPhba0VZI.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\Desktop\NKPhba0VZI.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Process created: C:\Users\user\Desktop\NKPhba0VZI.exe C:\Users\user\Desktop\NKPhba0VZI.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'Powershell.exe' -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe' 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Jump to behavior

Source: Yara match	File source: 0000000A.00000002.301353554.0000000005100000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.296957145.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.213095995.00000000056B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.209833769.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NKPhba0VZI.exe PID: 6112, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drivers.exe PID: 6520, type: MEMORY
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.56b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.4125d70.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3b9f940.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.5100000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3c05d70.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.4125d70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3b9f940.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3c05d70.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.40bf940.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.56b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.5100000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.40bf940.4.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 1_2_00D3960F push es; retf	1_2_00D39620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_075469E0 push es; ret	2_2_075469F0
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_0086960F push es; retf	5_2_00869620
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D0E472 push 8BFFFFFFh; retf	5_2_00D0E478
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Code function: 5_2_00D17A37 push edi; retn 0000h	5_2_00D17A39
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 10_2_0074960F push es; retf	10_2_00749620
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_04C612A1 push es; ret	15_2_04C612B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Code function: 20_2_009D960F push es; retf	20_2_009D9620

Source: initial sample	Static PE information: section name: .text entropy: 7.99096434579
Source: initial sample	Static PE information: section name: .text entropy: 7.99096434579

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2528	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 373	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Window / User API: threadDelayed 5577	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Window / User API: threadDelayed 4199	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5293	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1912	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Window / User API: threadDelayed 3617	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Window / User API: threadDelayed 6183	Jump to behavior

Source: C:\Users\user\Desktop\NKPhba0VZI.exe TID: 6116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5872	Thread sleep count: 2528 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5872	Thread sleep count: 373 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4744	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe TID: 6056	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe TID: 6060	Thread sleep count: 5577 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe TID: 6060	Thread sleep count: 4199 > 30	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe TID: 6056	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe TID: 6560	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6904	Thread sleep count: 5293 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6908	Thread sleep count: 1912 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6404	Thread sleep time: -17524406870024063s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7148	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe TID: 6408	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe TID: 6412	Thread sleep count: 3617 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe TID: 6412	Thread sleep count: 6183 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe TID: 6408	Thread sleep count: 44 > 30	Jump to behavior

Source: powershell.exe, 00000002.00000002.268373167.0000000004752000.00000004.00000001.sdmp	Binary or memory string: Hyper-V
Source: NKPhba0VZI.exe, 00000005.00000002.472580653.0000000000FC1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllws\system32;C:\Windows;C:\Windows\Syrr
Source: powershell.exe, 00000002.00000002.268373167.0000000004752000.00000004.00000001.sdmp	Binary or memory string: l:C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Hyper-V

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Process token adjusted: Debug	Jump to behavior

Source: NKPhba0VZI.exe, 00000005.00000002.473807628.00000000016D0000.00000002.00000001.sdmp, Drivers.exe, 00000014.00000002.472360748.00000000017B0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: NKPhba0VZI.exe, 00000005.00000002.473807628.00000000016D0000.00000002.00000001.sdmp, Drivers.exe, 00000014.00000002.472360748.00000000017B0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: NKPhba0VZI.exe, 00000005.00000002.473807628.00000000016D0000.00000002.00000001.sdmp, Drivers.exe, 00000014.00000002.472360748.00000000017B0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: NKPhba0VZI.exe, 00000005.00000002.473807628.00000000016D0000.00000002.00000001.sdmp, Drivers.exe, 00000014.00000002.472360748.00000000017B0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Users\user\Desktop\NKPhba0VZI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Users\user\Desktop\NKPhba0VZI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NKPhba0VZI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 00000001.00000003.199780118.0000000001408000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.473641028.0000000002DF1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.296957145.0000000003B39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.285607498.0000000000D75000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.209833769.0000000004059000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.474695925.0000000002C41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.463182723.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.463217997.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NKPhba0VZI.exe PID: 6112, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drivers.exe PID: 6520, type: MEMORY
Source: Yara match	File source: Process Memory Space: NKPhba0VZI.exe PID: 6064, type: MEMORY
Source: Yara match	File source: Process Memory Space: Drivers.exe PID: 6980, type: MEMORY
Source: Yara match	File source: 5.2.NKPhba0VZI.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Drivers.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3ca23b8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3c05d70.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.4125d70.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3b9f940.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Drivers.exe.3ca23b8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.41c23b8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.41c23b8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.NKPhba0VZI.exe.40bf940.4.raw.unpack, type: UNPACKEDPE

ID:	358333
Product:	CloudBasic
Start time:	12:24:29
Start date:	25.02.2021
Sample:	NKPhba0VZI.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	3a89cf2d6d2449ef1a9640af29f3a782
SHA1:	220b9c5b4c7e9de15753f629da1ac3a075dc0800
SHA256:	3d652eb897291f8eb2fe8f9374007388b0cd426a797de77545b82a325dde762a
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Drivers.exe.log	ASCII text, with CRLF line terminators	3A72FBECA73A61C00EECBDEC37EAD411	E2330F7B3182A857BB477B2492DDECC2A8488211	2D4310C4AB9ADEFD6169137CD8973D23D779EDD968B8B39DBC072BF888D0802C
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NKPhba0VZI.exe.log	ASCII text, with CRLF line terminators	3A72FBECA73A61C00EECBDEC37EAD411	E2330F7B3182A857BB477B2492DDECC2A8488211	2D4310C4AB9ADEFD6169137CD8973D23D779EDD968B8B39DBC072BF888D0802C
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	E47E850408CFEC13093B384E274EA249	ABD257A58EB6B5E6D9A1B4BA816DF75CFA852CCD	45B758B05B461164070A22FC3531EC92EB40C66C1B58A02875C56F1C9043A4D8
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bnmp4ebp.syx.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1rqppmh.xce.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j5urz4n2.cbm.ps1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uwlodmhm.as4.psm1	very short file (no magic)	C4CA4238A0B923820DCC509A6F75849B	356A192B7913B04C54574D18C28D46E6395428AB	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	3A89CF2D6D2449EF1A9640AF29F3A782	220B9C5B4C7E9DE15753F629DA1AC3A075DC0800	3D652EB897291F8EB2FE8F9374007388B0CD426A797DE77545B82A325DDE762A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\Documents\20210225\PowerShell_transcript.376483.hZkrHILO.20210225122601.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	75CF527A9A62A1535AF090EAB85D3B13	A28F4E2601C912DB36BC61D191B97D09C2DCD932	B3E6EB4BA0FB020B015CD20C39ABEA0575DD71EEB4CA619D7E4D4ADE3F5B4771
C:\Users\user\Documents\20210225\PowerShell_transcript.376483.uDG1lXLj.20210225122519.txt	UTF-8 Unicode (with BOM) text, with CRLF line terminators	46A2861BB28560404EB6E971178C990C	483341174306970C6E5AEB9BE69DC3913C0DE0FA	E8C880B7ED410EE403654BFB489D5134666E03626B97473D27131427473B97F1

Analysis Report NKPhba0VZI.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains