Analysis Report 99feb78a_by_Libranalysis

Overview

General Information

Sample Name:	99feb78a_by_Libranalysis (renamed file extension from none to xlsx)
Analysis ID:	412910
MD5:	99feb78ab55c66b871d8998b20528b61
SHA1:	1c96f08e92401f2396ad0b074ca55049a773e4e0
SHA256:	5f4e4fbde7ed003dc34954ee301977f697de1cd2d52beafd898023797ab47255
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code contains very large array initializations

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Yara detected Credential Stealer

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000006.00000002.2237439431.00000000021A1000.00000004.00000001.sdmp

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "SMTP Info": "sales@orienttech.com.qaOp{^fLb9gN[!mail.orienttech.com.qapdsctsops@gmail.com"}

Multi AV Scanner detection for domain / URL

Source: carbinz.gq

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\joewealthx[1].exe	ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for submitted file

Source: 99feb78a_by_Libranalysis.xlsx	Virustotal: Detection: 39%			Perma Link
Source: 99feb78a_by_Libranalysis.xlsx	ReversingLabs: Detection: 43%

Machine Learning detection for sample

Source: 99feb78a_by_Libranalysis.xlsx

Joe Sandbox ML: detected

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe			Jump to behavior

Office Equation Editor has been started

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49169 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49170 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49171 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49172 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49174 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49175 -> 162.241.85.66:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.22:49176 -> 162.241.85.66:587

Source: Joe Sandbox View	IP Address: 162.241.85.66 162.241.85.66
Source: Joe Sandbox View	IP Address: 185.239.243.112 185.239.243.112

Source: Joe Sandbox View	ASN Name: OIS1US OIS1US
Source: Joe Sandbox View	ASN Name: CLOUDIE-AS-APCloudieLimitedHK CLOUDIE-AS-APCloudieLimitedHK

Source: joewealth28743.exe, 00000004.00000002.2352749717.00000000023B1000.00000004.00000001.sdmp, Nwefile.exe, 00000006.00000002.2237439431.00000000021A1000.00000004.00000001.sdmp, Nwefile.exe, 00000008.00000002.2352252684.0000000002371000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: Nwefile.exe, 00000008.00000002.2352252684.0000000002371000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: joewealth28743.exe, 00000004.00000002.2353553201.000000000260C000.00000004.00000001.sdmp, Nwefile.exe, 00000008.00000002.2352689728.0000000002498000.00000004.00000001.sdmp	String found in binary or memory: http://mail.orienttech.com.qa
Source: joewealth28743.exe, 00000004.00000002.2357578553.0000000005BE0000.00000002.00000001.sdmp, Nwefile.exe, 00000006.00000002.2240959548.0000000005E30000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: joewealth28743.exe, 00000004.00000002.2357578553.0000000005BE0000.00000002.00000001.sdmp, Nwefile.exe, 00000006.00000002.2240959548.0000000005E30000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: Nwefile.exe, 00000008.00000002.2352252684.0000000002371000.00000004.00000001.sdmp	String found in binary or memory: http://yyfqMq.com
Source: joewealth28743.exe, 00000004.00000002.2353787746.000000000278B000.00000004.00000001.sdmp	String found in binary or memory: https://YbUuTY812ORW4eX3VhL.com
Source: joewealth28743.exe, 00000004.00000002.2352896428.000000000243A000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%
Source: Nwefile.exe, 00000008.00000002.2352252684.0000000002371000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: joewealth28743.exe, 00000003.00000002.2143882626.000000000361B000.00000004.00000001.sdmp, joewealth28743.exe, 00000004.00000002.2351274027.0000000000402000.00000040.00000001.sdmp, Nwefile.exe, 00000005.00000002.2216387056.000000000333B000.00000004.00000001.sdmp, Nwefile.exe, 00000006.00000002.2236823411.0000000000402000.00000040.00000001.sdmp, Nwefile.exe, 00000007.00000002.2239066475.00000000035BB000.00000004.00000001.sdmp, Nwefile.exe, 00000008.00000002.2351324007.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: joewealth28743.exe, 00000004.00000002.2352749717.00000000023B1000.00000004.00000001.sdmp, Nwefile.exe, 00000006.00000002.2237439431.00000000021A1000.00000004.00000001.sdmp, Nwefile.exe, 00000008.00000002.2352252684.0000000002371000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

Source: 4.2.joewealth28743.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b6D46FB52u002dC9CBu002d4CF2u002dBDD4u002dC0EDA502A803u007d/EA0D635Du002d0B4Cu002d4E47u002dB864u002dA02C362BD2F0.cs	Large array initialization: .cctor: array initializer size 11955
Source: 6.2.Nwefile.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b6D46FB52u002dC9CBu002d4CF2u002dBDD4u002dC0EDA502A803u007d/EA0D635Du002d0B4Cu002d4E47u002dB864u002dA02C362BD2F0.cs	Large array initialization: .cctor: array initializer size 11955
Source: 8.2.Nwefile.exe.400000.1.unpack, u003cPrivateImplementationDetailsu003eu007b6D46FB52u002dC9CBu002d4CF2u002dBDD4u002dC0EDA502A803u007d/EA0D635Du002d0B4Cu002d4E47u002dB864u002dA02C362BD2F0.cs	Large array initialization: .cctor: array initializer size 11955

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\joewealth28743.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\joewealthx[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00EF6091	3_2_00EF6091
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00296889	3_2_00296889
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029E8F8	3_2_0029E8F8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00293D08	3_2_00293D08
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_002955A8	3_2_002955A8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00295E22	3_2_00295E22
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029E630	3_2_0029E630
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029425F	3_2_0029425F
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029BEE2	3_2_0029BEE2
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029EB33	3_2_0029EB33
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00290308	3_2_00290308
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00292B60	3_2_00292B60
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029C3AA	3_2_0029C3AA
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299F88	3_2_00299F88
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_002977E8	3_2_002977E8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029101A	3_2_0029101A
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029E8E8	3_2_0029E8E8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299901	3_2_00299901
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299910	3_2_00299910
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029CD68	3_2_0029CD68
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299DA0	3_2_00299DA0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299D92	3_2_00299D92
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_002949F0	3_2_002949F0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029B5F5	3_2_0029B5F5
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029B5C0	3_2_0029B5C0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029B638	3_2_0029B638
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299271	3_2_00299271
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029C6A8	3_2_0029C6A8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_002986A8	3_2_002986A8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299280	3_2_00299280
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00298698	3_2_00298698
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029E328	3_2_0029E328
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299B21	3_2_00299B21
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00299B30	3_2_00299B30
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029AF98	3_2_0029AF98
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_0029AFC8	3_2_0029AFC8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 3_2_00540048	3_2_00540048
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00EF6091	4_2_00EF6091
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_003B52B8	4_2_003B52B8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_003B62D0	4_2_003B62D0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_003B5600	4_2_003B5600
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_003BEEB0	4_2_003BEEB0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_003B2010	4_2_003B2010
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00C717D0	4_2_00C717D0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00C70488	4_2_00C70488
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00C721B8	4_2_00C721B8
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DEBEC0	4_2_00DEBEC0
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DE8280	4_2_00DE8280
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DE0048	4_2_00DE0048
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DE3420	4_2_00DE3420
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DEA338	4_2_00DEA338
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DEE730	4_2_00DEE730
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DEBE10	4_2_00DEBE10
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Code function: 4_2_00DEADC0	4_2_00DEADC0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_008B6091	5_2_008B6091
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D6889	5_2_002D6889
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DE8F8	5_2_002DE8F8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D3D08	5_2_002D3D08
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D55A8	5_2_002D55A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D5E28	5_2_002D5E28
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DE630	5_2_002DE630
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D425F	5_2_002D425F
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DBEE8	5_2_002DBEE8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DEB33	5_2_002DEB33
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D0308	5_2_002D0308
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D2B60	5_2_002D2B60
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DC3B0	5_2_002DC3B0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9F88	5_2_002D9F88
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D77E8	5_2_002D77E8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D1020	5_2_002D1020
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D5880	5_2_002D5880
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DE8E8	5_2_002DE8E8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9901	5_2_002D9901
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9910	5_2_002D9910
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DCD68	5_2_002DCD68
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9DA0	5_2_002D9DA0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9D98	5_2_002D9D98
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D49F0	5_2_002D49F0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DAA28	5_2_002DAA28
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9271	5_2_002D9271
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DC6A8	5_2_002DC6A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D86A8	5_2_002D86A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D7AA5	5_2_002D7AA5
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9280	5_2_002D9280
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D8698	5_2_002D8698
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DE328	5_2_002DE328
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9B21	5_2_002D9B21
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D9B30	5_2_002D9B30
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D6300	5_2_002D6300
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002D3FA8	5_2_002D3FA8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DAF98	5_2_002DAF98
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_002DAFC8	5_2_002DAFC8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 5_2_00470048	5_2_00470048
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 6_2_008B6091	6_2_008B6091
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 6_2_002052B8	6_2_002052B8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 6_2_002062D0	6_2_002062D0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 6_2_00205600	6_2_00205600
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E6889	7_2_002E6889
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EE8F8	7_2_002EE8F8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E3D08	7_2_002E3D08
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E55A8	7_2_002E55A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E5E22	7_2_002E5E22
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EE630	7_2_002EE630
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E425F	7_2_002E425F
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EBEE2	7_2_002EBEE2
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EEB33	7_2_002EEB33
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E0308	7_2_002E0308
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E2B60	7_2_002E2B60
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EC3AA	7_2_002EC3AA
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9F88	7_2_002E9F88
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E77E8	7_2_002E77E8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E101A	7_2_002E101A
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E587A	7_2_002E587A
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EE8E8	7_2_002EE8E8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9901	7_2_002E9901
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9910	7_2_002E9910
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002ECD68	7_2_002ECD68
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9DA0	7_2_002E9DA0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9D92	7_2_002E9D92
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EB5F5	7_2_002EB5F5
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E49F0	7_2_002E49F0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EB5C0	7_2_002EB5C0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EAA28	7_2_002EAA28
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EB638	7_2_002EB638
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9271	7_2_002E9271
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EC6A8	7_2_002EC6A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E86A8	7_2_002E86A8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9280	7_2_002E9280
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E8698	7_2_002E8698
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EE328	7_2_002EE328
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9B21	7_2_002E9B21
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E9B30	7_2_002E9B30
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002E3FA8	7_2_002E3FA8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EAF98	7_2_002EAF98
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_002EAFC8	7_2_002EAFC8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 7_2_003F0048	7_2_003F0048
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 8_2_001E52B8	8_2_001E52B8
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 8_2_001E62D0	8_2_001E62D0
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Code function: 8_2_001E5600	8_2_001E5600

Source: joewealthx[1].exe.1.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Nwefile.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 4.2.joewealth28743.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.joewealth28743.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.Nwefile.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.Nwefile.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 8.2.Nwefile.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 8.2.Nwefile.exe.400000.1.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe C:\Users\user\AppData\Roaming\joewealth28743.exe
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe 'C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe'
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe 'C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe'
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe {path}
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe C:\Users\user\AppData\Roaming\joewealth28743.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Process created: C:\Users\user\AppData\Roaming\joewealth28743.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process created: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe {path}	Jump to behavior

Source: joewealthx[1].exe.1.dr, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.joewealth28743.exe.ef0000.0.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.joewealth28743.exe.ef0000.2.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: Nwefile.exe.4.dr, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.joewealth28743.exe.ef0000.4.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.joewealth28743.exe.ef0000.0.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Nwefile.exe.8b0000.0.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Nwefile.exe.8b0000.1.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.Nwefile.exe.8b0000.3.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Nwefile.exe.8b0000.0.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.2.Nwefile.exe.8b0000.1.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 7.0.Nwefile.exe.8b0000.0.unpack, MainForm.cs	.Net Code: _N_ System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: initial sample	Static PE information: section name: .text entropy: 7.29768214208
Source: initial sample	Static PE information: section name: .text entropy: 7.29768214208

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Nwefile			Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Nwefile			Jump to behavior

Source: Yara match	File source: Process Memory Space: joewealth28743.exe PID: 1980, type: MEMORY
Source: Yara match	File source: Process Memory Space: Nwefile.exe PID: 2664, type: MEMORY
Source: Yara match	File source: Process Memory Space: Nwefile.exe PID: 2768, type: MEMORY

Source: joewealth28743.exe, 00000003.00000002.2142270666.00000000023D4000.00000004.00000001.sdmp, Nwefile.exe, 00000005.00000002.2214264595.00000000020F6000.00000004.00000001.sdmp, Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: joewealth28743.exe, 00000003.00000002.2142270666.00000000023D4000.00000004.00000001.sdmp, Nwefile.exe, 00000005.00000002.2214264595.00000000020F6000.00000004.00000001.sdmp, Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Analysis Report 99feb78a_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Window / User API: threadDelayed 514	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Window / User API: threadDelayed 9221	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Window / User API: threadDelayed 404	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Window / User API: threadDelayed 2686	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Window / User API: threadDelayed 9526	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2596	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 912	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 2180	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3044	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3044	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3060	Thread sleep count: 514 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3060	Thread sleep count: 9221 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe TID: 3044	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 1800	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2596	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 1944	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 1944	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2924	Thread sleep count: 404 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2952	Thread sleep count: 2686 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2996	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 2648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3052	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3020	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3020	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3064	Thread sleep count: 9526 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3064	Thread sleep count: 221 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe TID: 3020	Thread sleep count: 100 > 30	Jump to behavior

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 31500	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Nwefile.exe, 00000007.00000002.2237024296.0000000002376000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Memory written: C:\Users\user\AppData\Roaming\joewealth28743.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory written: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Memory written: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: joewealth28743.exe, 00000004.00000002.2352649918.0000000000FB0000.00000002.00000001.sdmp, Nwefile.exe, 00000008.00000002.2351879422.0000000000C30000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: joewealth28743.exe, 00000004.00000002.2352649918.0000000000FB0000.00000002.00000001.sdmp, Nwefile.exe, 00000008.00000002.2351879422.0000000000C30000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: joewealth28743.exe, 00000004.00000002.2352649918.0000000000FB0000.00000002.00000001.sdmp, Nwefile.exe, 00000008.00000002.2351879422.0000000000C30000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Queries volume information: C:\Users\user\AppData\Roaming\joewealth28743.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Queries volume information: C:\Users\user\AppData\Roaming\joewealth28743.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\joewealth28743.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Nwefile\Nwefile.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2236823411.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2239066475.00000000035BB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2143882626.000000000361B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2216387056.000000000333B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2351324007.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2351274027.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 8.2.Nwefile.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Nwefile.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Nwefile.exe.33d6ac0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Nwefile.exe.33d6ac0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.joewealth28743.exe.36b6ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.joewealth28743.exe.36b6ac0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.joewealth28743.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Nwefile.exe.3656ac0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Nwefile.exe.3656ac0.5.unpack, type: UNPACKEDPE