Analysis Report pitEBNziGR

ID:	376866
Product:	CloudBasic
Start time:	15:01:51
Start date:	27.03.2021
Sample:	pitEBNziGR
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	ecbc4b40dcfec4ed1b2647b217da0441
SHA1:	e08eb07c69d8fc8e75927597767288a21d6ed7f6
SHA256:	878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Network\Downloader\edb.log	data	A3BBD08F5479FAB589EE84226696C232	BD1187F796B0BF8CCB464B50070B19E819A862E5	B3DC7DCF4A61669A9C96BD58F281D599B232DF0D8DC657919588F99E35D319BA
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db	Extensible storage engine DataBase, version 0x620, checksum 0x71939413, page size 16384, DirtyShutdown, Windows version 10.0	8CEEAE58F264E4E07A8B3D2C00F0176D	4D72DFF69C813A2105776E78318EC4EAA867723E	F0A754C4B93D9BC3F48D0BF876734599F45ACC0B2B73CBA29423E0788CFADF81
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm	data	4C3F3659EAEC18E81982E371D5B45E0F	F0182FB4D8AEF66779E3B83F590C424AC08DE57E	DA5F115297D2AE8B90C365F6EF71CC72D700E9E0E2159F7FBDEC81DC5BCAE4A5
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl	data	54DA1703769BA18D0E4389DCD34FDB7D	EFCE7BCAF94B11669985B80D3676B9424F31EFD0	E089A40924007DBE883AAAB811E46183AAF263EFA0E88AEA0E7C8C0E84C568F8
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl	data	D163D7519023BA3C7A42E55CE6C7F221	91048E720FEEEBEFB67A3C54A7FCDC5BADD61BDF	CC40A44A6C61957CDB1C915F56D45A723ACF117DE73F0686E5AE4B604BBAD3A0
C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl	data	5818E45437BF82ECE76B765F53B0A7BE	0CFB80910B2B0D32B9BCE745229DA51A7F0D5363	5CD3B1123AADBFF207B79A528FDA5EA0AD82562CB32AF04447A491A109A86A91
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	ASCII text, with no line terminators	DCA83F08D448911A14C22EBCACC5AD57	91270525521B7FE0D986DB19747F47D34B6318AD	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log	data	F07D8F49D08C02BFE117BB591AD8A2FA	E5DF6866DA2685DEB7C6D979CB875606BA7F08F3	D3DBEEA6181FC06E01AEA5AC5D5FF9D3287D8BC581F6AA9133DABC2D1838E20D

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: pitEBNziGR.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: http://173.230.145.224:8080/	Virustotal: Detection: 6%			Perma Link
Source: http://193.169.54.12:8080/	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Source: pitEBNziGR.exe	Virustotal: Detection: 83%			Perma Link
Source: pitEBNziGR.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: pitEBNziGR.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: pitEBNziGR.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: pitEBNziGR.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.3:49722 -> 193.169.54.12:8080
Source: global traffic	TCP traffic: 192.168.2.3:49732 -> 173.230.145.224:8080

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 193.169.54.12 193.169.54.12
Source: Joe Sandbox View	IP Address: 173.230.145.224 173.230.145.224

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 97 72 e0 59 98 a6 57 df 28 e7 48 40 d4 d8 66 59 dc e8 1f bb ba 3e 21 1e 38 80 b6 ec ee 2a 1a a3 87 a9 c8 b4 ee ed dc a6 6f 47 9b 1e 06 04 e0 a5 a8 3e 98 71 5b 7c ec 3f d9 e4 3c 6f 39 b8 7e 2a 40 46 cf 1a a4 90 a6 15 44 8e 34 a1 21 30 73 1a e6 7d da 53 34 e9 8b 08 fd d2 65 b7 ef 4e 7b 1b 41 cf 1e 4e 04 67 cc b6 b0 8e b7 39 83 f2 85 7b a1 76 75 0b b7 56 49 19 1d 10 3a 94 65 9b 6e db f7 b7 29 b4 9a 96 57 3d ea 50 0f 80 91 3e 6c 5d 71 bf 0c d3 1d 33 2c 3a 9a 00 cf a7 c7 6e 8d 93 33 f1 a9 fe 49 f2 03 fe be 4b 22 73 87 0a 9f 61 aa f6 e6 a0 a1 63 62 25 cf 29 54 e3 40 05 0a ac 61 fb 48 f7 e2 51 c2 17 4b ed 50 6e 0f 9a 96 21 f2 fd 66 9d 79 03 73 e2 c1 d8 97 fd 28 89 6a 62 09 bd 80 74 21 8d 9c 6f be e5 fe 66 36 c6 f5 62 24 ad 3f ae e1 aa f8 d6 42 cc 1a d8 f1 89 6f d4 95 30 68 64 5c cc 00 d3 be a3 ab ce 3f 52 9f ab 9e f6 9e ca 9b 6b 13 0e ca 26 0e 82 55 62 9c 00 2e 21 f3 b7 c2 9d 7d 9f 04 f3 7e 0f c1 76 1a 7a 4b 82 60 af 42 06 7b 0a 93 6c fe 13 8f b9 4f 78 86 2b 0a ed 48 97 4d 62 66 9c 72 e1 05 9c 40 f9 8e 63 e2 1d 1f ad df 9d ec d9 92 31 7e ae 62 0d 09 5c 09 8c d1 5d d1 bc 4b 7f cb 09 5b 4c 65 2d 57 57 2b e3 5a 97 5b 02 cc 16 fd 31 6b b3 55 c4 2a 4e 8f ca 6b 96 64 58 fe 94 ef e4 92 ec 3c 15 62 55 43 64 8e 63 e9 8e 48 56 b5 de 1f 75 a2 6e 36 87 35 88 1b e3 52 6c ca 2f 39 c7 37 99 59 b5 08 78 45 5b Data Ascii: rYW(H@fY>!8*oG>q[|?<o9~*@FD4!0s}S4eN{ANg9{vuVI:en)W=P>l]q3,:n3IK"sacb%)T@aHQKPn!fys(jbt!of6b$?Bo0hd\?Rk&Ub.!}~vzK`B{lOx+HMbfr@c1~b\]K[Le-WW+Z[1kU*NkdX<bUCdcHVun65Rl/97YxE[

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 79.172.249.82
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 193.169.54.12
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.230.145.224

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 79.172.249.82:443Content-Length: 436Connection: Keep-AliveCache-Control: no-cacheData Raw: 97 72 e0 59 98 a6 57 df 28 e7 48 40 d4 d8 66 59 dc e8 1f bb ba 3e 21 1e 38 80 b6 ec ee 2a 1a a3 87 a9 c8 b4 ee ed dc a6 6f 47 9b 1e 06 04 e0 a5 a8 3e 98 71 5b 7c ec 3f d9 e4 3c 6f 39 b8 7e 2a 40 46 cf 1a a4 90 a6 15 44 8e 34 a1 21 30 73 1a e6 7d da 53 34 e9 8b 08 fd d2 65 b7 ef 4e 7b 1b 41 cf 1e 4e 04 67 cc b6 b0 8e b7 39 83 f2 85 7b a1 76 75 0b b7 56 49 19 1d 10 3a 94 65 9b 6e db f7 b7 29 b4 9a 96 57 3d ea 50 0f 80 91 3e 6c 5d 71 bf 0c d3 1d 33 2c 3a 9a 00 cf a7 c7 6e 8d 93 33 f1 a9 fe 49 f2 03 fe be 4b 22 73 87 0a 9f 61 aa f6 e6 a0 a1 63 62 25 cf 29 54 e3 40 05 0a ac 61 fb 48 f7 e2 51 c2 17 4b ed 50 6e 0f 9a 96 21 f2 fd 66 9d 79 03 73 e2 c1 d8 97 fd 28 89 6a 62 09 bd 80 74 21 8d 9c 6f be e5 fe 66 36 c6 f5 62 24 ad 3f ae e1 aa f8 d6 42 cc 1a d8 f1 89 6f d4 95 30 68 64 5c cc 00 d3 be a3 ab ce 3f 52 9f ab 9e f6 9e ca 9b 6b 13 0e ca 26 0e 82 55 62 9c 00 2e 21 f3 b7 c2 9d 7d 9f 04 f3 7e 0f c1 76 1a 7a 4b 82 60 af 42 06 7b 0a 93 6c fe 13 8f b9 4f 78 86 2b 0a ed 48 97 4d 62 66 9c 72 e1 05 9c 40 f9 8e 63 e2 1d 1f ad df 9d ec d9 92 31 7e ae 62 0d 09 5c 09 8c d1 5d d1 bc 4b 7f cb 09 5b 4c 65 2d 57 57 2b e3 5a 97 5b 02 cc 16 fd 31 6b b3 55 c4 2a 4e 8f ca 6b 96 64 58 fe 94 ef e4 92 ec 3c 15 62 55 43 64 8e 63 e9 8e 48 56 b5 de 1f 75 a2 6e 36 87 35 88 1b e3 52 6c ca 2f 39 c7 37 99 59 b5 08 78 45 5b Data Ascii: rYW(H@fY>!8*oG>q[|?<o9~*@FD4!0s}S4eN{ANg9{vuVI:en)W=P>l]q3,:n3IK"sacb%)T@aHQKPn!fys(jbt!of6b$?Bo0hd\?Rk&Ub.!}~vzK`B{lOx+HMbfr@c1~b\]K[Le-WW+Z[1kU*NkdX<bUCdcHVun65Rl/97YxE[

Urls found in memory or binary data

Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://173.230.145.224:8080/
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://173.230.145.224:8080/TM
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://173.230.145.224:8080/gM#
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://173.230.145.224:8080/l
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://193.169.54.12:8080/
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://193.169.54.12:8080/5
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://193.169.54.12:8080/_M
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://193.169.54.12:8080/ux
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	String found in binary or memory: http://79.172.249.82:443/
Source: svchost.exe, 00000006.00000002.462241785.0000028F2D8A9000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: svchost.exe, 00000006.00000002.462241785.0000028F2D8A9000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: svchost.exe, 00000006.00000002.464877515.0000028F33015000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: svchost.exe, 00000006.00000002.462241785.0000028F2D8A9000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: svchost.exe, 00000006.00000002.464505561.0000028F32EC0000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: svchost.exe, 0000000B.00000002.308355210.000001939C613000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 00000008.00000002.461881870.0000024118645000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000008.00000002.461881870.0000024118645000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000008.00000002.461881870.0000024118645000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000008.00000002.461803156.000002411862A000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000008.00000002.461803156.000002411862A000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.308383976.000001939C63E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000002.308394226.000001939C64D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000B.00000002.308383976.000001939C63E000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000B.00000003.308149953.000001939C641000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000B.00000003.308149953.000001939C641000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000B.00000003.308142924.000001939C657000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.308142924.000001939C657000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.308142924.000001939C657000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308394226.000001939C64D000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.308149953.000001939C641000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.308123717.000001939C65C000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000003.308146538.000001939C645000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000B.00000003.308104948.000001939C661000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.308383976.000001939C63E000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000B.00000003.286370110.000001939C631000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000B.00000002.308383976.000001939C63E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000B.00000002.308355210.000001939C613000.00000004.00000001.sdmp, svchost.exe, 0000000B.00000002.308383976.000001939C63E000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000B.00000003.286370110.000001939C631000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000B.00000003.308146538.000001939C645000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000B.00000003.286370110.000001939C631000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000B.00000002.308379172.000001939C63A000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000B.00000002.308394226.000001939C64D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713

E-Banking Fraud:

Yara detected Emotet

Source: Yara match	File source: pitEBNziGR.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.202612718.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.201565611.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.461283657.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.202311649.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.196081466.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.195720063.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194827594.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.202853899.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: pitEBNziGR.exe, type: SAMPLE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 3.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 2.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 1.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 3.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 0.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly
Source: 0.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet Payload Author: kevoreilly

Creates files inside the system directory

Source: C:\Windows\SysWOW64\audioservice.exe

File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache

Jump to behavior

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\pitEBNziGR.exe

File deleted: C:\Windows\SysWOW64\audioservice.exe:Zone.Identifier

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\pitEBNziGR.exe	Code function: 0_2_00A877F0		0_2_00A877F0
Source: C:\Users\user\Desktop\pitEBNziGR.exe	Code function: 0_2_00A86E70		0_2_00A86E70

Sample file is different than original file name gathered from version info

Source: pitEBNziGR.exe, 00000001.00000002.203635375.00000000031A0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs pitEBNziGR.exe
Source: pitEBNziGR.exe, 00000001.00000002.203635375.00000000031A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs pitEBNziGR.exe
Source: pitEBNziGR.exe, 00000001.00000002.203491288.0000000002F80000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs pitEBNziGR.exe

Tries to load missing DLLs

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Uses 32bit PE files

Source: pitEBNziGR.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: pitEBNziGR.exe, type: SAMPLE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 3.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 2.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 1.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 3.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 0.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload
Source: 0.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE	Matched rule: Emotet author = kevoreilly, description = Emotet Payload, cape_type = Emotet Payload

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@17/8@0/5

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A82110 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A82110

Creates files inside the user directory

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Creates mutexes

Source: C:\Users\user\Desktop\pitEBNziGR.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\M41F765F2
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1632:120:WilError_01
Source: C:\Users\user\Desktop\pitEBNziGR.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\I41F765F2
Source: C:\Windows\SysWOW64\audioservice.exe	Mutant created: \BaseNamedObjects\Global\I41F765F2
Source: C:\Users\user\Desktop\pitEBNziGR.exe	Mutant created: \Sessions\1\BaseNamedObjects\MCDA8B17A
Source: C:\Windows\SysWOW64\audioservice.exe	Mutant created: \BaseNamedObjects\M8D708131

PE file has an executable .text section and no other executable section

Source: pitEBNziGR.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\pitEBNziGR.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: pitEBNziGR.exe	Virustotal: Detection: 83%
Source: pitEBNziGR.exe	ReversingLabs: Detection: 96%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\pitEBNziGR.exe 'C:\Users\user\Desktop\pitEBNziGR.exe'
Source: C:\Users\user\Desktop\pitEBNziGR.exe	Process created: C:\Users\user\Desktop\pitEBNziGR.exe C:\Users\user\Desktop\pitEBNziGR.exe
Source: unknown	Process created: C:\Windows\SysWOW64\audioservice.exe C:\Windows\SysWOW64\audioservice.exe
Source: C:\Windows\SysWOW64\audioservice.exe	Process created: C:\Windows\SysWOW64\audioservice.exe C:\Windows\SysWOW64\audioservice.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pitEBNziGR.exe	Process created: C:\Users\user\Desktop\pitEBNziGR.exe C:\Users\user\Desktop\pitEBNziGR.exe			Jump to behavior
Source: C:\Windows\SysWOW64\audioservice.exe	Process created: C:\Windows\SysWOW64\audioservice.exe C:\Windows\SysWOW64\audioservice.exe			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe 'C:\Program Files\Windows Defender\mpcmdrun.exe' -wdenable			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: pitEBNziGR.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A81F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

0_2_00A81F40

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\audioservice.exe

Executable created and started: C:\Windows\SysWOW64\audioservice.exe

Jump to behavior

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\Desktop\pitEBNziGR.exe

PE file moved: C:\Windows\SysWOW64\audioservice.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\pitEBNziGR.exe

File opened: C:\Windows\SysWOW64\audioservice.exe:Zone.Identifier read attributes | delete

Jump to behavior

Disables application error messsages (SetErrorMode)

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\pitEBNziGR.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\pitEBNziGR.exe

API coverage: 6.5 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 5780

Thread sleep time: -30000s >= -30000s

Jump to behavior

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Checks the free space of harddrives

Source: C:\Users\user\Desktop\pitEBNziGR.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: svchost.exe, 00000008.00000002.462327310.0000024118CB0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: svchost.exe, 00000006.00000002.465111348.0000028F33062000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp, svchost.exe, 00000006.00000002.464973215.0000028F3304C000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000007.00000002.461443923.000001FA8E202000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000008.00000002.462327310.0000024118CB0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000006.00000002.462109237.0000028F2D82A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW=
Source: svchost.exe, 00000008.00000002.462327310.0000024118CB0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: audioservice.exe, 00000003.00000002.461836346.00000000010C8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWx"
Source: svchost.exe, 00000007.00000002.461491367.000001FA8E228000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.461881870.0000024118645000.00000004.00000001.sdmp, svchost.exe, 0000000A.00000002.461875734.000001FB4822A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000008.00000002.462327310.0000024118CB0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Windows\SysWOW64\audioservice.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A81F40 VirtualAlloc,memcpy,memcpy,LoadLibraryA,GetProcAddress,VirtualFree,

0_2_00A81F40

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A81BE0 mov eax, dword ptr fs:[00000030h]

0_2_00A81BE0

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A815B0 GetModuleFileNameW,_snwprintf,GetProcessHeap,HeapFree,_snwprintf,GetProcessHeap,HeapFree,CreateEventW,CreateMutexW,CloseHandle,GetLastError,SetEvent,CloseHandle,CloseHandle,memset,CreateProcessW,WaitForSingleObject,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

0_2_00A815B0

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: svchost.exe, 00000009.00000002.461898357.0000017862590000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000009.00000002.461898357.0000017862590000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000009.00000002.461898357.0000017862590000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000009.00000002.461898357.0000017862590000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\pitEBNziGR.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\audioservice.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Contains functionality to query windows version

Source: C:\Users\user\Desktop\pitEBNziGR.exe

Code function: 0_2_00A88D50 RtlGetVersion,GetNativeSystemInfo,

0_2_00A88D50

Queries the cryptographic machine GUID

Source: C:\Windows\SysWOW64\audioservice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

AV process strings found (often used to terminate AV products)

Source: svchost.exe, 0000000D.00000002.461551398.00000217B463D000.00000004.00000001.sdmp	Binary or memory string: &@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000D.00000002.461608468.00000217B4702000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Emotet

Source: Yara match	File source: pitEBNziGR.exe, type: SAMPLE
Source: Yara match	File source: 00000002.00000002.202612718.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.201565611.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.461283657.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.202311649.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.196081466.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.195720063.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.194827594.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.202853899.0000000000A81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.audioservice.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.pitEBNziGR.exe.a80000.0.unpack, type: UNPACKEDPE