Analysis Report DNPr7t0GMY

Overview

General Information

Sample Name:	DNPr7t0GMY (renamed file extension from none to exe)
Analysis ID:	432808
MD5:	f41951980d050c8fe13c8a2e31e55b94
SHA1:	58be890ff4d29b2d17566420c0e455dbfccda9a8
SHA256:	12f07790ce9303ed023131642a93d1b62ce4f3d5db8d35ed215d5b2bddc4ff93
Tags:	exetrojan
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

.NET source code contains very large strings

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Found malware configuration

Source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}

Multi AV Scanner detection for submitted file

Source: DNPr7t0GMY.exe	Virustotal: Detection: 55%	Perma Link
Source: DNPr7t0GMY.exe	Metadefender: Detection: 34%	Perma Link
Source: DNPr7t0GMY.exe	ReversingLabs: Detection: 60%

Yara detected FormBook

Source: Yara match	File source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: DNPr7t0GMY.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 4.0.DNPr7t0GMY.exe.400000.1.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.2.DNPr7t0GMY.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: DNPr7t0GMY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: DNPr7t0GMY.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: msdt.pdbGCTL source: DNPr7t0GMY.exe, 00000004.00000002.272130410.0000000002D50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: DNPr7t0GMY.exe, 00000004.00000002.271750109.000000000113F000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.481988311.0000000004CB0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: DNPr7t0GMY.exe, 00000004.00000002.271750109.000000000113F000.00000040.00000001.sdmp, msdt.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\jrFIryXeZK\src\obj\Debug\AppDomainTimerSafeHandle.pdb source: DNPr7t0GMY.exe
Source:	Binary string: C:\Users\Administrator\Desktop\Client\Temp\jrFIryXeZK\src\obj\Debug\AppDomainTimerSafeHandle.pdb,L source: DNPr7t0GMY.exe
Source:	Binary string: msdt.pdb source: DNPr7t0GMY.exe, 00000004.00000002.272130410.0000000002D50000.00000040.00000001.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4x nop then pop edi	4_2_00416282
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4x nop then pop ebx	4_2_00406A94
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 4x nop then pop ebx	10_2_00786A95
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 4x nop then pop edi	10_2_00796282

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49749 -> 199.195.117.147:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49749 -> 199.195.117.147:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49749 -> 199.195.117.147:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.adultpeace.com/p2io/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=FG8u3oFaRD5TAlzINClu9ACxgqrSnZ6gPOUiGbwcreYFYk5tnmBon+VN227RveoPSR01 HTTP/1.1Host: www.yunlimall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=403u/w6B7XptcAEzuvN4cykoFcXgffqxcXNiYWMFmnIxKaVZCbECctw1BX3Z+wGMxAxa HTTP/1.1Host: www.painhut.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YhWug+Cxzy&1bs8=cR-P8LD8 HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=bgEje2qoIMshrcRflwWQjpUULYzLZlDcA+elzyDX4pz+rZVwSlMQ2+HN9bOaKrviR/d6 HTTP/1.1Host: www.thriveglucose.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=tOwaJov1NmitprcRi3+vLu8KpTdHs2Vuljzq3uMGq4g841w++xy1kQ5hZRjCYd6IRkqR&1bs8=cR-P8LD8 HTTP/1.1Host: www.essentiallyourscandles.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=2q6D4S4IYN7aWdcEo+dmfNOnFlWkohYFDzpy6Q1cDMIvB7dycn+zvuYm9OtfZIW5A7WG HTTP/1.1Host: www.ololmychartlogin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIDpWXBn/Ha HTTP/1.1Host: www.swayam-moj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=OHUffbgtyxVuJk/N29fk0Sz2RAv4pH8VLsDTaDI27e1IsTBLt6kjVq3G5jK+CrAnEI1b&1bs8=cR-P8LD8 HTTP/1.1Host: www.brunoecatarina.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=WkKybY+EW+ZFcjRL6hKPcEEM/Z4gp4PnllRo5afgEdT4hrEaW59DTbMK1uLBueD84dbw HTTP/1.1Host: www.ruhexuangou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 142.111.47.2 142.111.47.2
Source: Joe Sandbox View	IP Address: 23.82.57.32 23.82.57.32

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: EGIHOSTINGUS EGIHOSTINGUS
Source: Joe Sandbox View	ASN Name: LEASEWEB-USA-SFO-12US LEASEWEB-USA-SFO-12US

Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=FG8u3oFaRD5TAlzINClu9ACxgqrSnZ6gPOUiGbwcreYFYk5tnmBon+VN227RveoPSR01 HTTP/1.1Host: www.yunlimall.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=403u/w6B7XptcAEzuvN4cykoFcXgffqxcXNiYWMFmnIxKaVZCbECctw1BX3Z+wGMxAxa HTTP/1.1Host: www.painhut.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YhWug+Cxzy&1bs8=cR-P8LD8 HTTP/1.1Host: www.cleanxcare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=bgEje2qoIMshrcRflwWQjpUULYzLZlDcA+elzyDX4pz+rZVwSlMQ2+HN9bOaKrviR/d6 HTTP/1.1Host: www.thriveglucose.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=tOwaJov1NmitprcRi3+vLu8KpTdHs2Vuljzq3uMGq4g841w++xy1kQ5hZRjCYd6IRkqR&1bs8=cR-P8LD8 HTTP/1.1Host: www.essentiallyourscandles.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=2q6D4S4IYN7aWdcEo+dmfNOnFlWkohYFDzpy6Q1cDMIvB7dycn+zvuYm9OtfZIW5A7WG HTTP/1.1Host: www.ololmychartlogin.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIDpWXBn/Ha HTTP/1.1Host: www.swayam-moj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?-Z0xlN=OHUffbgtyxVuJk/N29fk0Sz2RAv4pH8VLsDTaDI27e1IsTBLt6kjVq3G5jK+CrAnEI1b&1bs8=cR-P8LD8 HTTP/1.1Host: www.brunoecatarina.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?1bs8=cR-P8LD8&-Z0xlN=WkKybY+EW+ZFcjRL6hKPcEEM/Z4gp4PnllRo5afgEdT4hrEaW59DTbMK1uLBueD84dbw HTTP/1.1Host: www.ruhexuangou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: <a href="https://www.facebook.com/casarpontocom" target="_blank" title="Facebook/casarpontocom"> equals www.facebook.com (Facebook)
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: <a href="https://www.youtube.com/casarpontocom" target="_blank" title="Youtube/casarpontocom"> equals www.youtube.com (Youtube)
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: <iframe src="//www.facebook.com/plugins/like.php?href=https%3A%2F%2Ffacebook.com%2FEventoCasar&width&layout=button_count&action=like&show_faces=false&share=false&height=21&appId=621352837957736" scrolling="no" frameborder="0" style="border:none; overflow:hidden; height:21px;" allowTransparency="true"></iframe> equals www.facebook.com (Facebook)
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: src="https://www.facebook.com/tr?id=912779795420526&ev=PageView&noscript=1" equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: www.yunlimall.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 10 Jun 2021 17:13:43 GMTContent-Type: text/htmlContent-Length: 153Connection: closeServer: nginx/1.16.1Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>

Source: explorer.exe, 00000005.00000000.241683015.0000000008A05000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: http://instagram.com/casarpontocom
Source: DNPr7t0GMY.exe, 00000002.00000002.220254281.00000000032E1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: http://www.pinterest.com/casarpontocom
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.241726965.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://casarpontocom.zendesk.com/hc/pt-br
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/es5-shim/4.5.14/es5-shim.min.js
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://connect.facebook.net/en_US/fbevents.js
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://embed.typeform.com/embed.js
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://plus.google.com/
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/casamentos/casamentos-reais/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/casamentos/decoracao-de-casamento/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/cha-de-panela/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/lua-de-mel-2/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/noivas/dicas-para-noivas/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/noivas/vestidos-de-noiva/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.casar.com/assunto/organizacao/
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-N7Z9MZC
Source: msdt.exe, 0000000A.00000002.483640962.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.youtube.com/casarpontocom

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large strings

Source: DNPr7t0GMY.exe, ISectionEntry.cs	Long String: Length: 326320
Source: 2.0.DNPr7t0GMY.exe.f10000.0.unpack, ISectionEntry.cs	Long String: Length: 326320
Source: 2.2.DNPr7t0GMY.exe.f10000.0.unpack, ISectionEntry.cs	Long String: Length: 326320
Source: 4.0.DNPr7t0GMY.exe.4f0000.2.unpack, ISectionEntry.cs	Long String: Length: 326320
Source: 4.0.DNPr7t0GMY.exe.4f0000.0.unpack, ISectionEntry.cs	Long String: Length: 326320
Source: 4.2.DNPr7t0GMY.exe.4f0000.1.unpack, ISectionEntry.cs	Long String: Length: 326320

Contains functionality to call native functions

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_004181B0 NtCreateFile,	4_2_004181B0
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00418260 NtReadFile,	4_2_00418260
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_004182E0 NtClose,	4_2_004182E0
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00418390 NtAllocateVirtualMemory,	4_2_00418390
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_004182AC NtReadFile,	4_2_004182AC
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041838B NtAllocateVirtualMemory,	4_2_0041838B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D195D0 NtClose,LdrInitializeThunk,	10_2_04D195D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19540 NtReadFile,LdrInitializeThunk,	10_2_04D19540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D196D0 NtCreateKey,LdrInitializeThunk,	10_2_04D196D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D196E0 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_04D196E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19650 NtQueryValueKey,LdrInitializeThunk,	10_2_04D19650
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19660 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_04D19660
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19FE0 NtCreateMutant,LdrInitializeThunk,	10_2_04D19FE0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19780 NtMapViewOfSection,LdrInitializeThunk,	10_2_04D19780
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19710 NtQueryInformationToken,LdrInitializeThunk,	10_2_04D19710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19840 NtDelayExecution,LdrInitializeThunk,	10_2_04D19840
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19860 NtQuerySystemInformation,LdrInitializeThunk,	10_2_04D19860
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D199A0 NtCreateSection,LdrInitializeThunk,	10_2_04D199A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19910 NtAdjustPrivilegesToken,LdrInitializeThunk,	10_2_04D19910
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19A50 NtCreateFile,LdrInitializeThunk,	10_2_04D19A50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D195F0 NtQueryInformationFile,	10_2_04D195F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19560 NtWriteFile,	10_2_04D19560
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D1AD30 NtSetContextThread,	10_2_04D1AD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19520 NtWaitForSingleObject,	10_2_04D19520
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19670 NtQueryInformationProcess,	10_2_04D19670
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19610 NtEnumerateValueKey,	10_2_04D19610
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D197A0 NtUnmapViewOfSection,	10_2_04D197A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D1A770 NtOpenThread,	10_2_04D1A770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19770 NtSetInformationFile,	10_2_04D19770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19760 NtOpenProcess,	10_2_04D19760
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D1A710 NtOpenProcessToken,	10_2_04D1A710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19730 NtQueryVirtualMemory,	10_2_04D19730
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D198F0 NtReadVirtualMemory,	10_2_04D198F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D198A0 NtWriteVirtualMemory,	10_2_04D198A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D1B040 NtSuspendThread,	10_2_04D1B040
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19820 NtEnumerateKey,	10_2_04D19820
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D199D0 NtCreateProcessEx,	10_2_04D199D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19950 NtQueueApcThread,	10_2_04D19950
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19A80 NtOpenDirectoryObject,	10_2_04D19A80
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19A10 NtQuerySection,	10_2_04D19A10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19A00 NtProtectVirtualMemory,	10_2_04D19A00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19A20 NtResumeThread,	10_2_04D19A20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D1A3B0 NtGetContextThread,	10_2_04D1A3B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D19B00 NtSetValueKey,	10_2_04D19B00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_007981B0 NtCreateFile,	10_2_007981B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00798260 NtReadFile,	10_2_00798260
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_007982E0 NtClose,	10_2_007982E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00798390 NtAllocateVirtualMemory,	10_2_00798390
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_007982AC NtReadFile,	10_2_007982AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079838B NtAllocateVirtualMemory,	10_2_0079838B

Detected potential crypto function

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 2_2_0313C2B0	2_2_0313C2B0
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 2_2_031399A0	2_2_031399A0
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00401030	4_2_00401030
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B8B1	4_2_0041B8B1
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B963	4_2_0041B963
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00408C4B	4_2_00408C4B
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00408C50	4_2_00408C50
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B493	4_2_0041B493
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B496	4_2_0041B496
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041C539	4_2_0041C539
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00402D89	4_2_00402D89
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00402D90	4_2_00402D90
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041CE85	4_2_0041CE85
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041BF12	4_2_0041BF12
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041C795	4_2_0041C795
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00402FB0	4_2_00402FB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D9D466	10_2_04D9D466
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CE841F	10_2_04CE841F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA25DD	10_2_04DA25DD
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CED5E0	10_2_04CED5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D02581	10_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA1D55	10_2_04DA1D55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA2D07	10_2_04DA2D07
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CD0D20	10_2_04CD0D20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA2EF7	10_2_04DA2EF7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D9D616	10_2_04D9D616
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CF6E30	10_2_04CF6E30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA1FF1	10_2_04DA1FF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA28EC	10_2_04DA28EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CEB090	10_2_04CEB090
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D020A0	10_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA20A8	10_2_04DA20A8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D91002	10_2_04D91002
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CDF900	10_2_04CDF900
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04CF4120	10_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA22AE	10_2_04DA22AE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D9DBD2	10_2_04D9DBD2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D0EBB0	10_2_04D0EBB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04DA2B28	10_2_04DA2B28
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B8B1	10_2_0079B8B1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B954	10_2_0079B954
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00788C50	10_2_00788C50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00788C4B	10_2_00788C4B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B493	10_2_0079B493
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B496	10_2_0079B496
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079C539	10_2_0079C539
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00782D90	10_2_00782D90
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00782D89	10_2_00782D89
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079CE85	10_2_0079CE85
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079BF12	10_2_0079BF12
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00782FB0	10_2_00782FB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079C795	10_2_0079C795

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\msdt.exe

Code function: String function: 04CDB150 appears 35 times

Sample file is different than original file name gathered from version info

Source: DNPr7t0GMY.exe, 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameKygo.dll* vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe, 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe, 00000002.00000000.207658511.0000000001056000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAppDomainTimerSafeHandle.exeB vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe, 00000004.00000002.271750109.000000000113F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe, 00000004.00000002.271279344.0000000000636000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAppDomainTimerSafeHandle.exeB vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe, 00000004.00000002.272130410.0000000002D50000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemsdt.exej% vs DNPr7t0GMY.exe
Source: DNPr7t0GMY.exe	Binary or memory string: OriginalFilenameAppDomainTimerSafeHandle.exeB vs DNPr7t0GMY.exe

Uses 32bit PE files

Source: DNPr7t0GMY.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.478198621.0000000000C50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.216484865.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.220966733.00000000042E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.271117141.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.478065429.0000000000C20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.271551704.0000000000CF0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.477312798.0000000000780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.271485121.0000000000CC0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.DNPr7t0GMY.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.DNPr7t0GMY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.0.DNPr7t0GMY.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.DNPr7t0GMY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@13/10

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DNPr7t0GMY.exe.log

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: unknown	Process created: C:\Users\user\Desktop\DNPr7t0GMY.exe 'C:\Users\user\Desktop\DNPr7t0GMY.exe'
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process created: C:\Users\user\Desktop\DNPr7t0GMY.exe C:\Users\user\Desktop\DNPr7t0GMY.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\DNPr7t0GMY.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process created: C:\Users\user\Desktop\DNPr7t0GMY.exe C:\Users\user\Desktop\DNPr7t0GMY.exe	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\DNPr7t0GMY.exe'	Jump to behavior

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B2A2 push cs; ret	4_2_0041B2A3
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B3F2 push eax; ret	4_2_0041B3F8
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B3FB push eax; ret	4_2_0041B462
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B3A5 push eax; ret	4_2_0041B3F8
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041B45C push eax; ret	4_2_0041B462
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00415414 push esp; ret	4_2_00415416
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00414F46 push cs; ret	4_2_00414F47
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_0041BF12 push dword ptr [8427D5C5h]; ret	4_2_0041C1FF
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Code function: 4_2_00415FC5 push ebp; ret	4_2_00415FC6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_04D2D0D1 push ecx; ret	10_2_04D2D0E4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B2A2 push cs; ret	10_2_0079B2A3
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B3FB push eax; ret	10_2_0079B462
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B3F2 push eax; ret	10_2_0079B3F8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B3A5 push eax; ret	10_2_0079B3F8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079B45C push eax; ret	10_2_0079B462
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00795414 push esp; ret	10_2_00795416
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00794F46 push cs; ret	10_2_00794F47
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_0079BF12 push dword ptr [8427D5C5h]; ret	10_2_0079C1FF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 10_2_00795FC5 push ebp; ret	10_2_00795FC6

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: Yara match	File source: 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DNPr7t0GMY.exe PID: 6428, type: MEMORY

Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 00000000007885E4 second address: 00000000007885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 000000000078896E second address: 0000000000788974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe TID: 6432	Thread sleep time: -104955s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe TID: 6476	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4968	Thread sleep time: -50000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Thread delayed: delay time: 104955			Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000005.00000000.238628073.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.238628073.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.238425527.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.237897554.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000005.00000000.232822320.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000000.238628073.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.238628073.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.238741130.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000000.232851476.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.237897554.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.237897554.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000005.00000000.238628073.000000000871F000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAJ
Source: DNPr7t0GMY.exe, 00000002.00000002.220290008.0000000003320000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: msdt.exe, 0000000A.00000002.478405573.0000000000D31000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000005.00000000.237897554.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\explorer.exe	Network Connect: 142.111.47.2 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.yunlimall.com
Source: C:\Windows\explorer.exe	Domain query: www.thriveglucose.com
Source: C:\Windows\explorer.exe	Domain query: www.ololmychartlogin.com
Source: C:\Windows\explorer.exe	Network Connect: 13.59.53.244 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 54.85.86.211 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.kce0728com.net
Source: C:\Windows\explorer.exe	Domain query: www.cleanxcare.com
Source: C:\Windows\explorer.exe	Domain query: www.ruhexuangou.com
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.painhut.com
Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 212.32.237.92 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.essentiallyourscandles.com
Source: C:\Windows\explorer.exe	Domain query: www.brunoecatarina.com
Source: C:\Windows\explorer.exe	Network Connect: 23.82.57.32 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.swayam-moj.com
Source: C:\Windows\explorer.exe	Network Connect: 199.195.117.147 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 78.31.67.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.advancedaccessapplications.com

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Thread register set: target process: 3388			Jump to behavior

Source: explorer.exe, 00000005.00000000.251612925.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.251901669.0000000001980000.00000002.00000001.sdmp, msdt.exe, 0000000A.00000002.480683783.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.233903760.0000000006860000.00000004.00000001.sdmp, msdt.exe, 0000000A.00000002.480683783.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.251901669.0000000001980000.00000002.00000001.sdmp, msdt.exe, 0000000A.00000002.480683783.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.251901669.0000000001980000.00000002.00000001.sdmp, msdt.exe, 0000000A.00000002.480683783.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Users\user\Desktop\DNPr7t0GMY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\DNPr7t0GMY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
142.111.47.2	www.yunlimall.com	United States	18779	EGIHOSTINGUS	true
23.82.57.32	www.ruhexuangou.com	United States	7203	LEASEWEB-USA-SFO-12US	true
13.59.53.244	prod-sav-park-lb01-1919960993.us-east-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
54.85.86.211	www.brunoecatarina.com	United States	14618	AMAZON-AESUS	true
23.227.38.74	shops.myshopify.com	Canada	13335	CLOUDFLARENETUS	true
199.195.117.147	swayam-moj.com	United States	55293	A2HOSTINGUS	true
184.168.131.241	thriveglucose.com	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	true
212.32.237.92	www.ololmychartlogin.com	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	true
78.31.67.91	cleanxcare.com	Germany	24961	MYLOC-ASIPBackboneofmyLocmanagedITAGDE	true

Name	Malicious	Antivirus Detection	Reputation
http://www.brunoecatarina.com/p2io/?-Z0xlN=OHUffbgtyxVuJk/N29fk0Sz2RAv4pH8VLsDTaDI27e1IsTBLt6kjVq3G5jK+CrAnEI1b&1bs8=cR-P8LD8	true	Avira URL Cloud: safe	unknown
http://www.cleanxcare.com/p2io/?-Z0xlN=pxlxKDN0Rvw8YUTnsB4Bv4ohCC0AYWvU81fxb+r9dLiNjjqdMXiyL1Lf04YhWug+Cxzy&1bs8=cR-P8LD8	true	Avira URL Cloud: safe	unknown
http://www.ololmychartlogin.com/p2io/?1bs8=cR-P8LD8&-Z0xlN=2q6D4S4IYN7aWdcEo+dmfNOnFlWkohYFDzpy6Q1cDMIvB7dycn+zvuYm9OtfZIW5A7WG	true	Avira URL Cloud: safe	unknown
www.adultpeace.com/p2io/	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.swayam-moj.com/p2io/?1bs8=cR-P8LD8&-Z0xlN=0YkKA47wwnQsSd2I7kPMKR9IRaKfA7HvmAjNs5nkCsbL4/Nj4Thso/t2FfIDpWXBn/Ha	true	Avira URL Cloud: safe	unknown
http://www.essentiallyourscandles.com/p2io/?-Z0xlN=tOwaJov1NmitprcRi3+vLu8KpTdHs2Vuljzq3uMGq4g841w++xy1kQ5hZRjCYd6IRkqR&1bs8=cR-P8LD8	true	Avira URL Cloud: safe	unknown
http://www.ruhexuangou.com/p2io/?1bs8=cR-P8LD8&-Z0xlN=WkKybY+EW+ZFcjRL6hKPcEEM/Z4gp4PnllRo5afgEdT4hrEaW59DTbMK1uLBueD84dbw	true	Avira URL Cloud: safe	unknown
http://www.yunlimall.com/p2io/?1bs8=cR-P8LD8&-Z0xlN=FG8u3oFaRD5TAlzINClu9ACxgqrSnZ6gPOUiGbwcreYFYk5tnmBon+VN227RveoPSR01	true	Avira URL Cloud: safe	unknown
http://www.thriveglucose.com/p2io/?1bs8=cR-P8LD8&-Z0xlN=bgEje2qoIMshrcRflwWQjpUULYzLZlDcA+elzyDX4pz+rZVwSlMQ2+HN9bOaKrviR/d6	true	Avira URL Cloud: safe	unknown

Analysis Report DNPr7t0GMY

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

ID:	432808
Product:	CloudBasic
Start time:	19:11:34
Start date:	10.06.2021
Sample:	DNPr7t0GMY
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	f41951980d050c8fe13c8a2e31e55b94
SHA1:	58be890ff4d29b2d17566420c0e455dbfccda9a8
SHA256:	12f07790ce9303ed023131642a93d1b62ce4f3d5db8d35ed215d5b2bddc4ff93
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%