Play interactive tour

Edit tour

Analysis Report XQehPgTn35.exe

Overview

General Information

Sample Name:	XQehPgTn35.exe
Analysis ID:	433012
MD5:	595c00bf9ca4baa42b4490f2782cf2d3
SHA1:	d1441cc336655f36efc3db070f84701a1f68e51a
SHA256:	6884ac9f82a44a7702c4807deec1640b66eb71f6c750dd0ca1d5d78632e626b5
Tags:	exenjratRAT
Infos:
Most interesting Screenshot:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Njrat

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to spread to USB devices (.Net source)

Creates autorun.inf (USB autostart)

Disables the Windows task manager (taskmgr)

Drops PE files to the document folder of the user

Drops PE files to the startup folder

Drops executables to the windows directory (C:\Windows) and starts them

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

PE file has nameless sections

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Netsh Port or Application Allowed

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

XQehPgTn35.exe (PID: 6468 cmdline: 'C:\Users\user\Desktop\XQehPgTn35.exe' MD5: 595C00BF9CA4BAA42B4490F2782CF2D3)

server.exe (PID: 6616 cmdline: 'C:\Windows\server.exe' MD5: 595C00BF9CA4BAA42B4490F2782CF2D3)

netsh.exe (PID: 6700 cmdline: netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 3544 cmdline: netsh firewall delete allowedprogram 'C:\Windows\server.exe' MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5700 cmdline: netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 1740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Microsoft Corporation.exe (PID: 5900 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe' MD5: 595C00BF9CA4BAA42B4490F2782CF2D3)

Google.exe (PID: 6716 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe' MD5: 595C00BF9CA4BAA42B4490F2782CF2D3)

cleanup

Malware Configuration

Threatname: Njrat

{"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "714bcaf02dc680243f761ccdcdc54f71", "Install Dir": "system 32", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Host": "[i]", "Port": "MTU0MDkg", "Network Seprator": "714bcaf02dc680243f761ccdcdc54f71", "Mutex Name": "False", "BSOD Active": "MTU0MDkg", "Pastebin Link": "Software\\Microsoft\\Windows\\CurrentVersion\\Run"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
XQehPgTn35.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\SublimeText.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\system 32.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Windows\server.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Umbrella.flv.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
C:\Program Files (x86)\Google.exe	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1585d:$reg: SEE_MASK_NOZONECHECKS 0x154e3:$msg: Execute ERROR 0x15537:$msg: Execute ERROR 0x15aaf:$ping: cmd.exe /c ping 0 -n 2 & del
0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1585d:$reg: SEE_MASK_NOZONECHECKS 0x154e3:$msg: Execute ERROR 0x15537:$msg: Execute ERROR 0x15aaf:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1585d:$reg: SEE_MASK_NOZONECHECKS 0x154e3:$msg: Execute ERROR 0x15537:$msg: Execute ERROR 0x15aaf:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: Google.exe PID: 6716	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: XQehPgTn35.exe PID: 6468	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Microsoft Corporation.exe PID: 5900	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.server.exe.9c0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
11.0.Microsoft Corporation.exe.da0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
0.0.XQehPgTn35.exe.ae0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
14.0.Google.exe.1310000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x1162b1:$s1: zffb(==
0.2.XQehPgTn35.exe.ae0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.2.XQehPgTn35.exe.ae0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15c5d:$reg: SEE_MASK_NOZONECHECKS 0x158e3:$msg: Execute ERROR 0x15937:$msg: Execute ERROR 0x15eaf:$ping: cmd.exe /c ping 0 -n 2 & del
11.2.Microsoft Corporation.exe.da0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
11.2.Microsoft Corporation.exe.da0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15c5d:$reg: SEE_MASK_NOZONECHECKS 0x158e3:$msg: Execute ERROR 0x15937:$msg: Execute ERROR 0x15eaf:$ping: cmd.exe /c ping 0 -n 2 & del
14.2.Google.exe.1310000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
14.2.Google.exe.1310000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15c5d:$reg: SEE_MASK_NOZONECHECKS 0x158e3:$msg: Execute ERROR 0x15937:$msg: Execute ERROR 0x15eaf:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE, CommandLine: netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE, CommandLine|base64offset|contains: l, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: 'C:\Windows\server.exe' , ParentImage: C:\Windows\server.exe, ParentProcessId: 6616, ProcessCommandLine: netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE, ProcessId: 6700

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: XQehPgTn35.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Windows\server.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\system 32.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Umbrella.flv.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\Program Files (x86)\Google.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047
Source: C:\SublimeText.exe	Avira: detection malicious, Label: HEUR/AGEN.1128047

Found malware configuration

Show sources

Source: 11.2.Microsoft Corporation.exe.da0000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "HacKed", "Version": "0.7d", "Install Name": "714bcaf02dc680243f761ccdcdc54f71", "Install Dir": "system 32", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Host": "[i]", "Port": "MTU0MDkg", "Network Seprator": "714bcaf02dc680243f761ccdcdc54f71", "Mutex Name": "False", "BSOD Active": "MTU0MDkg", "Pastebin Link": "Software\\Microsoft\\Windows\\CurrentVersion\\Run"}

Multi AV Scanner detection for domain / URL

Show sources

Source: 4.tcp.ngrok.io

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Program Files (x86)\Google.exe	Virustotal: Detection: 44%	Perma Link
Source: C:\Program Files (x86)\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Program Files (x86)\Google.exe	ReversingLabs: Detection: 61%
Source: C:\SublimeText.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\SublimeText.exe	ReversingLabs: Detection: 61%
Source: C:\Umbrella.flv.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Umbrella.flv.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Google.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Metadefender: Detection: 42%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	ReversingLabs: Detection: 61%

Multi AV Scanner detection for submitted file

Show sources

Source: XQehPgTn35.exe	Virustotal: Detection: 44%	Perma Link
Source: XQehPgTn35.exe	Metadefender: Detection: 42%	Perma Link
Source: XQehPgTn35.exe	ReversingLabs: Detection: 61%

Yara detected Njrat

Show sources

Source: Yara match	File source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Google.exe PID: 6716, type: MEMORY
Source: Yara match	File source: Process Memory Space: XQehPgTn35.exe PID: 6468, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 5900, type: MEMORY
Source: Yara match	File source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Windows\server.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\system 32.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Umbrella.flv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google.exe	Joe Sandbox ML: detected
Source: C:\SublimeText.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: XQehPgTn35.exe

Joe Sandbox ML: detected

Source: 11.2.Microsoft Corporation.exe.da0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.2.XQehPgTn35.exe.afc000.1.unpack	Avira: Label: TR/Patched.Ren.Gen2
Source: 14.2.Google.exe.132c000.2.unpack	Avira: Label: TR/Patched.Ren.Gen2
Source: 14.2.Google.exe.1310000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 11.2.Microsoft Corporation.exe.dbc000.2.unpack	Avira: Label: TR/Patched.Ren.Gen2
Source: 0.2.XQehPgTn35.exe.ae0000.0.unpack	Avira: Label: TR/Dropper.Gen

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Unpacked PE file: 0.2.XQehPgTn35.exe.ae0000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Unpacked PE file: 11.2.Microsoft Corporation.exe.da0000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Unpacked PE file: 14.2.Google.exe.1310000.0.unpack

Source: XQehPgTn35.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Spreading:

Contains functionality to spread to USB devices (.Net source)

Show sources

Source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, Usb1.cs	.Net Code: infect
Source: 14.2.Google.exe.1310000.0.unpack, Usb1.cs	.Net Code: infect

Creates autorun.inf (USB autostart)

Show sources

Source: C:\Windows\server.exe

File created: C:\autorun.inf

Jump to behavior

Source: XQehPgTn35.exe	Binary or memory string: [autorun]
Source: XQehPgTn35.exe	Binary or memory string: \autorun.inf
Source: XQehPgTn35.exe	Binary or memory string: autorun.inf
Source: Microsoft Corporation.exe	Binary or memory string: autorun.inf
Source: Microsoft Corporation.exe	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe	Binary or memory string: [autorun]
Source: Google.exe	Binary or memory string: [autorun]
Source: Google.exe	Binary or memory string: \autorun.inf
Source: Google.exe	Binary or memory string: autorun.inf
Source: autorun.inf.2.dr	Binary or memory string: [autorun]

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Code function: 0_2_00D67A2C FindFirstFileA,

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49727 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49729 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49730 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49731 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49732 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49733 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49734 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49735 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49736 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49737 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49738 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49739 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49740 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49741 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49742 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49743 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49744 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49745 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49746 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49747 -> 3.129.187.220:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49748 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49749 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49750 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49751 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49752 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49753 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49754 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49755 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49756 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49757 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49758 -> 3.136.65.236:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49759 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49760 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49761 -> 3.138.180.119:15409
Source: Traffic	Snort IDS: 2021176 ET TROJAN Bladabindi/njRAT CnC Command (ll) 192.168.2.3:49762 -> 3.138.180.119:15409

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: [i]

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic	TCP traffic: 3.136.65.236 ports 0,1,15409,4,5,9
Source: global traffic	TCP traffic: 3.129.187.220 ports 0,1,15409,4,5,9
Source: global traffic	TCP traffic: 3.138.180.119 ports 0,1,15409,4,5,9

Source: global traffic	TCP traffic: 192.168.2.3:49727 -> 3.138.180.119:15409
Source: global traffic	TCP traffic: 192.168.2.3:49730 -> 3.129.187.220:15409
Source: global traffic	TCP traffic: 192.168.2.3:49748 -> 3.136.65.236:15409

Source: Joe Sandbox View	IP Address: 3.129.187.220 3.129.187.220
Source: Joe Sandbox View	IP Address: 3.138.180.119 3.138.180.119
Source: Joe Sandbox View	IP Address: 3.136.65.236 3.136.65.236

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown

DNS traffic detected: queries for: 4.tcp.ngrok.io

Source: Google.exe, Google.exe, 0000000E.00000002.286075738.000000000132C000.00000040.00020000.sdmp	String found in binary or memory: http://www.enigmaprotector.com/
Source: XQehPgTn35.exe, 00000000.00000002.201116536.0000000000AFC000.00000040.00020000.sdmp, Microsoft Corporation.exe, 0000000B.00000002.254136129.0000000000DBC000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286075738.000000000132C000.00000040.00020000.sdmp	String found in binary or memory: http://www.enigmaprotector.com/openU

Source: Microsoft Corporation.exe, 0000000B.00000002.253950253.0000000000C4A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\server.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud:

Yara detected Njrat

Show sources

Source: Yara match	File source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Google.exe PID: 6716, type: MEMORY
Source: Yara match	File source: Process Memory Space: XQehPgTn35.exe PID: 6468, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 5900, type: MEMORY
Source: Yara match	File source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

PE file has nameless sections

Show sources

Source: XQehPgTn35.exe	Static PE information: section name:
Source: XQehPgTn35.exe	Static PE information: section name:
Source: XQehPgTn35.exe	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:

Source: C:\Windows\server.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File created: C:\Windows\server.exe

Jump to behavior

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00AE2050
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594298
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03595459
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594B5B
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_0359505D
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594544
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_0359536F
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_0359470F
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03595000
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594630
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594936
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594F2F
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_035947D4
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_035949F9
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_035944F1
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_035950E3
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_0359499D
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594F9D
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594C8F
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_03594287
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Code function: 11_2_00DA2050
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Code function: 14_2_01312050

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Code function: String function: 00B00264 appears 61 times

Source: XQehPgTn35.exe, 00000000.00000002.204876570.0000000006500000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs XQehPgTn35.exe
Source: XQehPgTn35.exe, 00000000.00000002.204876570.0000000006500000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs XQehPgTn35.exe
Source: XQehPgTn35.exe, 00000000.00000002.204526243.0000000006400000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs XQehPgTn35.exe

Source: XQehPgTn35.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: XQehPgTn35.exe, type: SAMPLE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\SublimeText.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\system 32.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Windows\server.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: C:\Program Files (x86)\Google.exe, type: DROPPED	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.0.server.exe.9c0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 11.0.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.0.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.0.Google.exe.1310000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: XQehPgTn35.exe	Static PE information: Section: ZLIB complexity 0.989884561567
Source: XQehPgTn35.exe	Static PE information: Section: .data ZLIB complexity 0.997420238423
Source: server.exe.0.dr	Static PE information: Section: ZLIB complexity 0.989884561567
Source: server.exe.0.dr	Static PE information: Section: .data ZLIB complexity 0.997420238423
Source: Google.exe.2.dr	Static PE information: Section: ZLIB complexity 0.989884561567
Source: Google.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.997420238423
Source: Microsoft Corporation.exe.2.dr	Static PE information: Section: ZLIB complexity 0.989884561567
Source: Microsoft Corporation.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.997420238423
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: Section: ZLIB complexity 0.989884561567
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.997420238423

Source: classification engine

Classification label: mal100.spre.troj.adwa.evad.winEXE@14/27@35/3

Source: C:\Windows\server.exe

File created: C:\Program Files (x86)\Google.exe

Jump to behavior

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_01
Source: C:\Windows\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\714bcaf02dc680243f761ccdcdc54f71
Source: C:\Windows\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6136:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1740:120:WilError_01

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\server.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\server.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\server.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\server.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\server.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: XQehPgTn35.exe	Virustotal: Detection: 44%
Source: XQehPgTn35.exe	Metadefender: Detection: 42%
Source: XQehPgTn35.exe	ReversingLabs: Detection: 61%

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File read: C:\Users\user\Desktop\XQehPgTn35.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XQehPgTn35.exe 'C:\Users\user\Desktop\XQehPgTn35.exe'
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process created: C:\Windows\server.exe 'C:\Windows\server.exe'
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram 'C:\Windows\server.exe'
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe'
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process created: C:\Windows\server.exe 'C:\Windows\server.exe'
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram 'C:\Windows\server.exe'
Source: C:\Windows\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: XQehPgTn35.exe

Static file information: File size 1143296 > 1048576

Source: C:\Users\user\Desktop\XQehPgTn35.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Unpacked PE file: 0.2.XQehPgTn35.exe.ae0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:ER;.data:ER;
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Unpacked PE file: 11.2.Microsoft Corporation.exe.da0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:ER;.data:ER;
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Unpacked PE file: 14.2.Google.exe.1310000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:ER;.data:ER;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Unpacked PE file: 0.2.XQehPgTn35.exe.ae0000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Unpacked PE file: 11.2.Microsoft Corporation.exe.da0000.0.unpack
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Unpacked PE file: 14.2.Google.exe.1310000.0.unpack

.NET source code contains potential unpacker

Show sources

Source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 14.2.Google.exe.1310000.0.unpack, Stub/Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: XQehPgTn35.exe	Static PE information: section name:
Source: XQehPgTn35.exe	Static PE information: section name:
Source: XQehPgTn35.exe	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: server.exe.0.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Google.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: Microsoft Corporation.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:
Source: 714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe.2.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B09089 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B09075 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B091FF push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B18104 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C2A8 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B153A0 push 00B15400h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C394 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C3F4 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B043EA push 00B04418h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B093D9 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B1832C push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B09311 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C355 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B04494 push 00B044C0h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B1549B push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B15484 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B1848C push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B044F8 push 00B0452Ch; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C4E4 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B04424 push 00B04450h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B09453 push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B16454 push 00B164A1h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0445C push 00B04488h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0945F push ss; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C448 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B18448 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B025F0 push 00B02641h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B14536 push 00B145B5h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C514 push es; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B15577 push 00B155A4h; ret
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Code function: 0_2_00B0C55C push 00B0C6D8h; ret

Source: initial sample	Static PE information: section name: entropy: 7.97927562362
Source: initial sample	Static PE information: section name: .data entropy: 7.9850157277
Source: initial sample	Static PE information: section name: entropy: 7.97927562362
Source: initial sample	Static PE information: section name: .data entropy: 7.9850157277
Source: initial sample	Static PE information: section name: entropy: 7.97927562362
Source: initial sample	Static PE information: section name: .data entropy: 7.9850157277
Source: initial sample	Static PE information: section name: entropy: 7.97927562362
Source: initial sample	Static PE information: section name: .data entropy: 7.9850157277
Source: initial sample	Static PE information: section name: entropy: 7.97927562362
Source: initial sample	Static PE information: section name: .data entropy: 7.9850157277

Persistence and Installation Behavior:

Drops PE files to the document folder of the user

Show sources

Source: C:\Windows\server.exe

File created: C:\Users\user\Documents\Google.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Executable created and started: C:\Windows\server.exe

Source: C:\Windows\server.exe	File created: C:\Users\user\Desktop\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\Documents\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Program Files (x86)\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\Favorites\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Umbrella.flv.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Local\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Windows\SysWOW64\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\SublimeText.exe	Jump to dropped file
Source: C:\Users\user\Desktop\XQehPgTn35.exe	File created: C:\Windows\server.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\system 32.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file

Source: C:\Windows\server.exe

File created: C:\Program Files (x86)\Google.exe

Jump to dropped file

Source: C:\Windows\server.exe	File created: C:\Windows\SysWOW64\Google.exe			Jump to dropped file
Source: C:\Users\user\Desktop\XQehPgTn35.exe	File created: C:\Windows\server.exe			Jump to dropped file

Boot Survival:

Drops PE files to the startup folder

Show sources

Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Jump to dropped file
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file

Source: C:\Windows\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Jump to behavior

Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to behavior
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	Jump to behavior
Source: C:\Windows\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Jump to behavior

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\XQehPgTn35.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\server.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\server.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Window / User API: threadDelayed 718
Source: C:\Windows\server.exe	Window / User API: threadDelayed 404
Source: C:\Windows\server.exe	Window / User API: threadDelayed 398
Source: C:\Windows\server.exe	Window / User API: foregroundWindowGot 567

Source: C:\Users\user\Desktop\XQehPgTn35.exe TID: 6472	Thread sleep count: 718 > 30
Source: C:\Users\user\Desktop\XQehPgTn35.exe TID: 6572	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\server.exe TID: 6652	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\server.exe TID: 6780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 5696	Thread sleep count: 91 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 2100	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe TID: 6744	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Code function: 0_2_00D67A2C FindFirstFileA,

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\server.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\

Source: Google.exe	Binary or memory string: VBoxService.exe
Source: XQehPgTn35.exe, Microsoft Corporation.exe, 0000000B.00000002.255054974.0000000000F02000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286192987.0000000001472000.00000040.00020000.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: XQehPgTn35.exe, Microsoft Corporation.exe, 0000000B.00000002.255054974.0000000000F02000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286192987.0000000001472000.00000040.00020000.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: Google.exe	Binary or memory string: VMWare
Source: XQehPgTn35.exe, 00000000.00000002.201236294.0000000000C42000.00000040.00020000.sdmp, Microsoft Corporation.exe, 0000000B.00000002.255054974.0000000000F02000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286192987.0000000001472000.00000040.00020000.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: Google.exe, 0000000E.00000002.286075738.000000000132C000.00000040.00020000.sdmp	Binary or memory string: &VBoxService.exe

Source: C:\Windows\server.exe

Process information queried: ProcessInformation

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\XQehPgTn35.exe	Thread information set: HideFromDebugger
Source: C:\Windows\server.exe	Thread information set: HideFromDebugger
Source: C:\Windows\server.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	Thread information set: HideFromDebugger

Source: C:\Windows\server.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Process created: C:\Windows\server.exe 'C:\Windows\server.exe'

Source: XQehPgTn35.exe, 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, Microsoft Corporation.exe, 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: XQehPgTn35.exe, 00000000.00000002.204294219.0000000005F3B000.00000004.00000001.sdmp, Microsoft Corporation.exe, 0000000B.00000002.257313375.00000000036C1000.00000004.00000001.sdmp, Google.exe, 0000000E.00000002.288890371.00000000032F6000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: XQehPgTn35.exe, Microsoft Corporation.exe, Google.exe	Binary or memory string: Shell_TrayWnd
Source: XQehPgTn35.exe, Microsoft Corporation.exe, Google.exe	Binary or memory string: ProgMan
Source: XQehPgTn35.exe, 00000000.00000002.202841791.0000000003E63000.00000004.00000001.sdmp, Microsoft Corporation.exe, 0000000B.00000002.257313375.00000000036C1000.00000004.00000001.sdmp, Google.exe, 0000000E.00000002.288890371.00000000032F6000.00000004.00000001.sdmp	Binary or memory string: kredProgram Manager
Source: XQehPgTn35.exe, 00000000.00000002.204294219.0000000005F3B000.00000004.00000001.sdmp, Microsoft Corporation.exe, 0000000B.00000002.257529987.000000000598B000.00000004.00000001.sdmp, Google.exe, 0000000E.00000002.289379384.000000000557B000.00000004.00000001.sdmp	Binary or memory string: rdProgram Manager
Source: XQehPgTn35.exe, Microsoft Corporation.exe, Google.exe	Binary or memory string: Shell_traywnd

Source: C:\Users\user\Desktop\XQehPgTn35.exe

Code function: GetLocaleInfoA,

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings:

Disables the Windows task manager (taskmgr)

Show sources

Source: C:\Windows\server.exe

Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Modifies the windows firewall

Show sources

Source: C:\Windows\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE

Stealing of Sensitive Information:

Yara detected Njrat

Show sources

Source: Yara match	File source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Google.exe PID: 6716, type: MEMORY
Source: Yara match	File source: Process Memory Space: XQehPgTn35.exe PID: 6468, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 5900, type: MEMORY
Source: Yara match	File source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Njrat

Show sources

Source: Yara match	File source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Google.exe PID: 6716, type: MEMORY
Source: Yara match	File source: Process Memory Space: XQehPgTn35.exe PID: 6468, type: MEMORY
Source: Yara match	File source: Process Memory Space: Microsoft Corporation.exe PID: 5900, type: MEMORY
Source: Yara match	File source: 0.2.XQehPgTn35.exe.ae0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Microsoft Corporation.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Google.exe.1310000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Replication Through Removable Media21	Windows Management Instrumentation	Startup Items1	Startup Items1	Masquerading132	Input Capture1	Security Software Discovery211	Replication Through Removable Media21	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder12	Process Injection12	Disable or Modify Tools31	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder12	Virtualization/Sandbox Evasion131	Security Account Manager	Virtualization/Sandbox Evasion131	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection12	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Peripheral Device Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information3	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing33	DCSync	File and Directory Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery22	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XQehPgTn35.exe	44%	Virustotal		Browse
XQehPgTn35.exe	43%	Metadefender		Browse
XQehPgTn35.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
XQehPgTn35.exe	100%	Avira	HEUR/AGEN.1128047
XQehPgTn35.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Windows\server.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\system 32.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Umbrella.flv.exe	100%	Avira	HEUR/AGEN.1128047
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Avira	HEUR/AGEN.1128047
C:\SublimeText.exe	100%	Avira	HEUR/AGEN.1128047
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Windows\server.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\system 32.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	100%	Joe Sandbox ML
C:\SublimeText.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google.exe	44%	Virustotal		Browse
C:\Program Files (x86)\Google.exe	43%	Metadefender		Browse
C:\Program Files (x86)\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\SublimeText.exe	43%	Metadefender		Browse
C:\SublimeText.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Umbrella.flv.exe	43%	Metadefender		Browse
C:\Umbrella.flv.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Google.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	43%	Metadefender		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	62%	ReversingLabs	Win32.Backdoor.Bladabhindi

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.2.Microsoft Corporation.exe.da0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
14.0.Google.exe.1310000.0.unpack	100%	Avira	HEUR/AGEN.1128047	Download File
0.2.XQehPgTn35.exe.afc000.1.unpack	100%	Avira	TR/Patched.Ren.Gen2	Download File
14.2.Google.exe.132c000.2.unpack	100%	Avira	TR/Patched.Ren.Gen2	Download File
14.2.Google.exe.1310000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
11.2.Microsoft Corporation.exe.dbc000.2.unpack	100%	Avira	TR/Patched.Ren.Gen2	Download File
2.0.server.exe.9c0000.0.unpack	100%	Avira	HEUR/AGEN.1128047	Download File
0.0.XQehPgTn35.exe.ae0000.0.unpack	100%	Avira	HEUR/AGEN.1128047	Download File
11.0.Microsoft Corporation.exe.da0000.0.unpack	100%	Avira	HEUR/AGEN.1128047	Download File
0.2.XQehPgTn35.exe.ae0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
4.tcp.ngrok.io	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.enigmaprotector.com/	1%	Virustotal		Browse
http://www.enigmaprotector.com/	0%	Avira URL Cloud	safe
[i]	0%	Avira URL Cloud	safe
http://www.enigmaprotector.com/openU	1%	Virustotal		Browse
http://www.enigmaprotector.com/openU	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
4.tcp.ngrok.io	3.138.180.119	true	true	12%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
[i]	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.enigmaprotector.com/	Google.exe, Google.exe, 0000000E.00000002.286075738.000000000132C000.00000040.00020000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.enigmaprotector.com/openU	XQehPgTn35.exe, 00000000.00000002.201116536.0000000000AFC000.00000040.00020000.sdmp, Microsoft Corporation.exe, 0000000B.00000002.254136129.0000000000DBC000.00000040.00020000.sdmp, Google.exe, 0000000E.00000002.286075738.000000000132C000.00000040.00020000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
3.129.187.220	unknown	United States	16509	AMAZON-02US	true
3.138.180.119	4.tcp.ngrok.io	United States	16509	AMAZON-02US	true
3.136.65.236	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	433012
Start date:	11.06.2021
Start time:	05:37:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 8s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	XQehPgTn35.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.adwa.evad.winEXE@14/27@35/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.6% (good quality ratio 7.4%) Quality average: 74% Quality standard deviation: 24.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 40.88.32.150, 104.42.151.234, 13.88.21.125, 23.218.208.56 Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, skypedataprdcoleus15.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net, skypedataprdcolwus15.cloudapp.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:38:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe
05:38:12	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
05:38:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
3.129.187.220	FiYBg9R8m0.exe	Get hash	malicious	Browse
	BWAlL8lrQb.exe	Get hash	malicious	Browse
	H4Q0I1RIuW.exe	Get hash	malicious	Browse
	CpOFmSHBGH.exe	Get hash	malicious	Browse
	GBtiwIB30h.exe	Get hash	malicious	Browse
	63C2AB0ECE24B47CDCFE2128789214F87451A3D82D641.exe	Get hash	malicious	Browse
	D3AAB88BB737961C971ED047B4C2D5B640EFF8E678781.exe	Get hash	malicious	Browse
	DC8DDCD4DB035FA647001A01CAB6A2866D092FCAAD182.exe	Get hash	malicious	Browse
	tmkfdBpwAx.exe	Get hash	malicious	Browse
	J6wDHe2QdA.exe	Get hash	malicious	Browse
	LGKacQbjeH.exe	Get hash	malicious	Browse
	qiCot2DU55.exe	Get hash	malicious	Browse
	YZJfsPAFBJ.exe	Get hash	malicious	Browse
	aYqoy7xF7y.exe	Get hash	malicious	Browse
	Krtw4Kl87V.exe	Get hash	malicious	Browse
	PsbfBdoToY.exe	Get hash	malicious	Browse
	BcaDguoEzV.exe	Get hash	malicious	Browse
	Oct Invoices 8984.exe	Get hash	malicious	Browse
	Invoices 489.exe	Get hash	malicious	Browse
	Invoices 073.exe	Get hash	malicious	Browse
3.138.180.119	BWAlL8lrQb.exe	Get hash	malicious	Browse
	0BFE93ABC8B3801B7E906960F6D69CC51088B76544EFC.exe	Get hash	malicious	Browse
	ooAUh9ba7E.exe	Get hash	malicious	Browse
	A6FAm1ae1j.exe	Get hash	malicious	Browse
	GBtiwIB30h.exe	Get hash	malicious	Browse
	vZvmgrCXam.exe	Get hash	malicious	Browse
	DC8DDCD4DB035FA647001A01CAB6A2866D092FCAAD182.exe	Get hash	malicious	Browse
	tmkfdBpwAx.exe	Get hash	malicious	Browse
	J6wDHe2QdA.exe	Get hash	malicious	Browse
	LGKacQbjeH.exe	Get hash	malicious	Browse
	aYqoy7xF7y.exe	Get hash	malicious	Browse
	Krtw4Kl87V.exe	Get hash	malicious	Browse
	zOlLBCUG9R.exe	Get hash	malicious	Browse
	ysJ2pAd54Z.exe	Get hash	malicious	Browse
	rQMm2jZD.exe	Get hash	malicious	Browse
	BcaDguoEzV.exe	Get hash	malicious	Browse
3.136.65.236	H4Q0I1RIuW.exe	Get hash	malicious	Browse
	ooAUh9ba7E.exe	Get hash	malicious	Browse
	CpOFmSHBGH.exe	Get hash	malicious	Browse
	GBtiwIB30h.exe	Get hash	malicious	Browse
	63C2AB0ECE24B47CDCFE2128789214F87451A3D82D641.exe	Get hash	malicious	Browse
	DC8DDCD4DB035FA647001A01CAB6A2866D092FCAAD182.exe	Get hash	malicious	Browse
	tmkfdBpwAx.exe	Get hash	malicious	Browse
	J6wDHe2QdA.exe	Get hash	malicious	Browse
	LGKacQbjeH.exe	Get hash	malicious	Browse
	qiCot2DU55.exe	Get hash	malicious	Browse
	yEh8mVeLA6.exe	Get hash	malicious	Browse
	XFdEhEAPeE.exe	Get hash	malicious	Browse
	YZJfsPAFBJ.exe	Get hash	malicious	Browse
	aYqoy7xF7y.exe	Get hash	malicious	Browse
	YFZX6dTsiT.exe	Get hash	malicious	Browse
	rQMm2jZD.exe	Get hash	malicious	Browse
	mNxVbma4uT.exe	Get hash	malicious	Browse
	BcaDguoEzV.exe	Get hash	malicious	Browse
	Invoices 485.exe	Get hash	malicious	Browse
	Invoices 489.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
4.tcp.ngrok.io	FiYBg9R8m0.exe	Get hash	malicious	Browse	3.133.207.110
	BWAlL8lrQb.exe	Get hash	malicious	Browse	3.129.187.220
	0BFE93ABC8B3801B7E906960F6D69CC51088B76544EFC.exe	Get hash	malicious	Browse	3.138.180.119
	H4Q0I1RIuW.exe	Get hash	malicious	Browse	3.129.187.220
	ooAUh9ba7E.exe	Get hash	malicious	Browse	3.133.207.110
	A6FAm1ae1j.exe	Get hash	malicious	Browse	3.133.207.110
	CpOFmSHBGH.exe	Get hash	malicious	Browse	3.133.207.110
	GBtiwIB30h.exe	Get hash	malicious	Browse	3.22.15.135
	vZvmgrCXam.exe	Get hash	malicious	Browse	3.138.180.119
	63C2AB0ECE24B47CDCFE2128789214F87451A3D82D641.exe	Get hash	malicious	Browse	3.136.65.236
	D3AAB88BB737961C971ED047B4C2D5B640EFF8E678781.exe	Get hash	malicious	Browse	3.22.15.135
	DC8DDCD4DB035FA647001A01CAB6A2866D092FCAAD182.exe	Get hash	malicious	Browse	3.129.187.220
	tmkfdBpwAx.exe	Get hash	malicious	Browse	3.131.147.49
	J6wDHe2QdA.exe	Get hash	malicious	Browse	3.136.65.236
	LGKacQbjeH.exe	Get hash	malicious	Browse	3.138.180.119
	qiCot2DU55.exe	Get hash	malicious	Browse	3.136.65.236
	yEh8mVeLA6.exe	Get hash	malicious	Browse	3.136.65.236
	XFdEhEAPeE.exe	Get hash	malicious	Browse	3.136.65.236
	YZJfsPAFBJ.exe	Get hash	malicious	Browse	3.131.147.49
	T91uHSVq.exe	Get hash	malicious	Browse	3.131.147.49

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	E1a92ARmPw.exe	Get hash	malicious	Browse	35.157.179.180
	crt9O3URua.exe	Get hash	malicious	Browse	35.157.179.180
	E1a92ARmPw.exe	Get hash	malicious	Browse	52.218.105.219
	DNPr7t0GMY.exe	Get hash	malicious	Browse	13.59.53.244
	lTAPQJikGw.exe	Get hash	malicious	Browse	99.83.154.118
	SKlGhwkzTi.exe	Get hash	malicious	Browse	44.227.65.245
	SecuriteInfo.com.Trojan.Packed2.43183.29557.exe	Get hash	malicious	Browse	13.59.53.244
	Letter 1019.xlsx	Get hash	malicious	Browse	18.140.1.169
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	143.204.98.37
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	75.2.26.18
	U03c2doc.exe	Get hash	malicious	Browse	108.128.238.226
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	18.140.1.169
	Docc.html	Get hash	malicious	Browse	13.224.99.74
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.209.246.140
	Sleek_Free.exe	Get hash	malicious	Browse	143.204.209.58
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.216.141.230
	#Ud83d#Udcde_#U25b6#Ufe0f.htm	Get hash	malicious	Browse	15.236.176.210
	WV Northern Community College.docx	Get hash	malicious	Browse	52.43.249.183
	wzdu53.exe	Get hash	malicious	Browse	13.249.13.113
	com.duolingo_1162_apps.evozi.com.apk	Get hash	malicious	Browse	52.222.174.5
AMAZON-02US	E1a92ARmPw.exe	Get hash	malicious	Browse	35.157.179.180
	crt9O3URua.exe	Get hash	malicious	Browse	35.157.179.180
	E1a92ARmPw.exe	Get hash	malicious	Browse	52.218.105.219
	DNPr7t0GMY.exe	Get hash	malicious	Browse	13.59.53.244
	lTAPQJikGw.exe	Get hash	malicious	Browse	99.83.154.118
	SKlGhwkzTi.exe	Get hash	malicious	Browse	44.227.65.245
	SecuriteInfo.com.Trojan.Packed2.43183.29557.exe	Get hash	malicious	Browse	13.59.53.244
	Letter 1019.xlsx	Get hash	malicious	Browse	18.140.1.169
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	143.204.98.37
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	75.2.26.18
	U03c2doc.exe	Get hash	malicious	Browse	108.128.238.226
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	18.140.1.169
	Docc.html	Get hash	malicious	Browse	13.224.99.74
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.209.246.140
	Sleek_Free.exe	Get hash	malicious	Browse	143.204.209.58
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.216.141.230
	#Ud83d#Udcde_#U25b6#Ufe0f.htm	Get hash	malicious	Browse	15.236.176.210
	WV Northern Community College.docx	Get hash	malicious	Browse	52.43.249.183
	wzdu53.exe	Get hash	malicious	Browse	13.249.13.113
	com.duolingo_1162_apps.evozi.com.apk	Get hash	malicious	Browse	52.222.174.5
AMAZON-02US	E1a92ARmPw.exe	Get hash	malicious	Browse	35.157.179.180
	crt9O3URua.exe	Get hash	malicious	Browse	35.157.179.180
	E1a92ARmPw.exe	Get hash	malicious	Browse	52.218.105.219
	DNPr7t0GMY.exe	Get hash	malicious	Browse	13.59.53.244
	lTAPQJikGw.exe	Get hash	malicious	Browse	99.83.154.118
	SKlGhwkzTi.exe	Get hash	malicious	Browse	44.227.65.245
	SecuriteInfo.com.Trojan.Packed2.43183.29557.exe	Get hash	malicious	Browse	13.59.53.244
	Letter 1019.xlsx	Get hash	malicious	Browse	18.140.1.169
	#U260e#Ufe0f Zeppelin.com AudioMessage_259-55.HTM	Get hash	malicious	Browse	143.204.98.37
	Proforma Invoice and Bank swift-REG.PI-0086547654.exe	Get hash	malicious	Browse	75.2.26.18
	U03c2doc.exe	Get hash	malicious	Browse	108.128.238.226
	Letter 09JUN 2021.xlsx	Get hash	malicious	Browse	18.140.1.169
	Docc.html	Get hash	malicious	Browse	13.224.99.74
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.209.246.140
	Sleek_Free.exe	Get hash	malicious	Browse	143.204.209.58
	ManyToOneMailMerge Ver 18.2.dotm	Get hash	malicious	Browse	52.216.141.230
	#Ud83d#Udcde_#U25b6#Ufe0f.htm	Get hash	malicious	Browse	15.236.176.210
	WV Northern Community College.docx	Get hash	malicious	Browse	52.43.249.183
	wzdu53.exe	Get hash	malicious	Browse	13.249.13.113
	com.duolingo_1162_apps.evozi.com.apk	Get hash	malicious	Browse	52.222.174.5

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Program Files (x86)\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Program Files (x86)\Google.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 44%, Browse Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SublimeText.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\SublimeText.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Umbrella.flv.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Umbrella.flv.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Google.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log Download File
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\XQehPgTn35.exe.log Download File
Process:	C:\Users\user\Desktop\XQehPgTn35.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.2874233355119316
Encrypted:	false
SSDEEP:	12:Q3LaJU20NaL10Ug+9Yz9t0U29hJ5g1B0U2ukyrFk7v:MLF20NaL3z2p29hJ5g522r0
MD5:	80EFBEC081D7836D240503C4C9465FEC
SHA1:	6AF398E08A359457083727BAF296445030A55AC3
SHA-256:	C73F730EB5E05D15FAD6BE10AB51FE4D8A80B5E88B89D8BC80CC1DF09ACE1523
SHA-512:	DEC3B1D9403894418AFD4433629CA6476C7BD359963328D17B93283B52EEC18B3725D2F02F0E9A142E705398DDDCE244D53829570E9DE1A87060A7DABFDCE5B3
Malicious:	true
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\cd7c74fce2a0eab72cd25cbe4bb61614\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\54d944b3ca0ea1188d700fbd8089726b\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\bd8d59c984c9f5f2695f64341115cdf0\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\714bcaf02dc680243f761ccdcdc54f71Windows Updater.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 43%, Browse Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\app Download File
Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe
File Type:	UTF-8 Unicode (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:yn:yn
MD5:	24E9E7D7EEA4DE90C8FC67AE1145ABF2
SHA1:	DD9BB46CCC6340CA892CF17EBE32B9BDBADEE2D1
SHA-256:	BD6C1D15579254E8879ADA07376F93CB2E959F45670374892FDE2EFAF4194F6C
SHA-512:	5572AFD61C7BA666515A987F23AD0A05AB753BDC28CFA492ADB30200207427A4A38699D3B7981E0750414775A4CE72A209511951D38A8673C709B08774FCA01F
Malicious:	false
Preview:	.11

C:\Users\user\Desktop\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Favorites\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Google.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\server.exe Download File
Process:	C:\Users\user\Desktop\XQehPgTn35.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Windows\server.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\autorun.inf Download File
Process:	C:\Windows\server.exe
File Type:	Microsoft Windows Autorun file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

C:\system 32.exe Download File
Process:	C:\Windows\server.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1143296
Entropy (8bit):	7.98927615016363
Encrypted:	false
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
MD5:	595C00BF9CA4BAA42B4490F2782CF2D3
SHA1:	D1441CC336655F36EFC3DB070F84701A1F68E51A
SHA-256:	6884AC9F82A44A7702C4807DEEC1640B66EB71F6C750DD0CA1D5D78632E626B5
SHA-512:	AAA673ADB4511D7E4BA5836F6874B047E8C2B31F86E005D46094A47626D23F97D72874307538C451541DBB44905503DF2227902E9F4CCFFA4D9836981ABCD2E6
Malicious:	true
Yara Hits:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\system 32.exe, Author: Florian Roth
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................. .)...............................).................................................................................................. ......................@............ ..........................@.............(.........................@....data....@....)..,...F..............@..................................................*FL............................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.98927615016363
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XQehPgTn35.exe
File size:	1143296
MD5:	595c00bf9ca4baa42b4490f2782cf2d3
SHA1:	d1441cc336655f36efc3db070f84701a1f68e51a
SHA256:	6884ac9f82a44a7702c4807deec1640b66eb71f6c750dd0ca1d5d78632e626b5
SHA512:	aaa673adb4511d7e4ba5836f6874b047e8c2b31f86e005d46094a47626d23f97d72874307538c451541dbb44905503df2227902e9f4ccffa4d9836981abcd2e6
SSDEEP:	24576:DPnLbQ9A/PFjHhefsVJ1ff9IS/+AhMrRekPHnu6DNO:DPImPFUQJVIg+WMrwOu6DN
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......`.................p............... ........@.. ........................8...........@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4087b0
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE
Time Stamp:	0x60B61FAE [Tue Jun 1 11:53:18 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2e5467cba76f44a088d39f78c5e807b6

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00401000h
call 00007F42888039D6h
call far 5DE5h : 8B10C483h
jmp 00007F4288B78961h
xchg eax, ebx
das
pop ecx
fimul word ptr [ecx]
scasd
jbe 00007F4288803992h
stc
outsb
mov dl, 89h
cmpsd
pop es
dec ebp
les ecx, fword ptr [edi]
stosd
salc
cmp ebx, dword ptr [ecx+23h]
salc
je 00007F42888039BAh
add al, 46h
jbe 00007F42888039CEh
in eax, 48h
imul eax, dword ptr [edx], 58FF3743h
dec ecx
jnbe 00007F4288803A01h
or eax, 5A7F49C4h
xchg eax, esi
mov ebx, dword ptr [edx]
call 00007F429F5EECBFh
sub ebx, dword ptr [eax+247EDDBBh]
in eax, dx
xchg dword ptr [ecx+esi*4+4Fh], ecx
lodsd
mov bh, 01h
xchg dword ptr [edx], ebx
push 0D715D85h
outsb
mov ch, 85h
loop 00007F4288803A38h
cwde
aad F9h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29c020	0x210	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x29c000	0xc	.data
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x18000	0x8600	False	0.989884561567	data	7.97927562362	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1a000	0x2000	0x200	False	0.0546875	data	0.305313057312	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
	0x1c000	0x280000	0x2ba00	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x29c000	0xe4000	0xe2c00	False	0.997420238423	data	7.9850157277	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/11/21-05:38:32.480901	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49727	15409	192.168.2.3	3.138.180.119
06/11/21-05:38:35.122490	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49729	15409	192.168.2.3	3.138.180.119
06/11/21-05:38:37.883521	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49730	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:40.816135	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49731	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:43.655370	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49732	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:46.534439	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49733	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:49.820340	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49734	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:52.550734	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49735	15409	192.168.2.3	3.129.187.220
06/11/21-05:38:55.325429	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49736	15409	192.168.2.3	3.138.180.119
06/11/21-05:38:58.026524	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49737	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:01.781328	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49738	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:04.485435	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49739	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:08.299471	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49740	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:10.989140	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49741	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:13.686687	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49742	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:16.472819	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49743	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:19.192478	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49744	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:21.879780	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49745	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:26.277451	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49746	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:28.697781	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49747	15409	192.168.2.3	3.129.187.220
06/11/21-05:39:31.432722	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49748	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:34.209617	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49749	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:36.900868	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49750	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:39.620373	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49751	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:43.395380	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49752	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:46.772436	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49753	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:49.556360	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49754	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:52.263322	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49755	15409	192.168.2.3	3.136.65.236
06/11/21-05:39:54.965375	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49756	15409	192.168.2.3	3.138.180.119
06/11/21-05:39:57.721057	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49757	15409	192.168.2.3	3.136.65.236
06/11/21-05:40:00.642878	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49758	15409	192.168.2.3	3.136.65.236
06/11/21-05:40:03.342398	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49759	15409	192.168.2.3	3.138.180.119
06/11/21-05:40:06.076276	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49760	15409	192.168.2.3	3.138.180.119
06/11/21-05:40:08.799968	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49761	15409	192.168.2.3	3.138.180.119
06/11/21-05:40:11.612120	TCP	2021176	ET TROJAN Bladabindi/njRAT CnC Command (ll)	49762	15409	192.168.2.3	3.138.180.119

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 05:38:28.263359070 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:28.404962063 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:28.405138016 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:28.994911909 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:29.109426975 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:32.480901003 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:32.623845100 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:32.624118090 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:32.764477015 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:33.060138941 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:33.071002007 CEST	15409	49727	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:33.071343899 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:34.743252993 CEST	49727	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:34.982126951 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:35.121546984 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.121665955 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:35.122489929 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:35.262887955 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.263066053 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:35.403242111 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.584269047 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.656944036 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:35.665175915 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.668739080 CEST	15409	49729	3.138.180.119	192.168.2.3
Jun 11, 2021 05:38:35.668905973 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:37.594604015 CEST	49729	15409	192.168.2.3	3.138.180.119
Jun 11, 2021 05:38:37.742187023 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:37.882061005 CEST	15409	49730	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:37.882210016 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:37.883521080 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:38.025667906 CEST	15409	49730	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:38.025789976 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:38.165572882 CEST	15409	49730	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:38.476670027 CEST	15409	49730	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:38.476713896 CEST	15409	49730	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:38.476943016 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:40.534037113 CEST	49730	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:40.671755075 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:40.813503981 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:40.813718081 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:40.816134930 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:40.956271887 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:40.956549883 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:41.096815109 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:41.281196117 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:41.344819069 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:41.352886915 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:41.353302956 CEST	15409	49731	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:41.353425980 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.291449070 CEST	49731	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.505050898 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.645172119 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:43.645334005 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.655369997 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.798135042 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:43.798265934 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:43.938019991 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:44.116847038 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:44.196537018 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:44.196671963 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:44.201392889 CEST	15409	49732	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:44.201508999 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.206796885 CEST	49732	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.322411060 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.466084003 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:46.466279030 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.534439087 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.674432039 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:46.674643993 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:46.814506054 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:46.977404118 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:47.048439026 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:47.071618080 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:47.078805923 CEST	15409	49733	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:47.078957081 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:49.130012989 CEST	49733	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:49.664273977 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:49.809375048 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:49.809490919 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:49.820339918 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:49.963341951 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:49.963480949 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:50.103955984 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:50.235722065 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:50.297827005 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:50.345540047 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:50.362777948 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:50.366107941 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:50.366185904 CEST	49734	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:50.507401943 CEST	15409	49734	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:52.409234047 CEST	49735	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:52.549846888 CEST	15409	49735	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:52.549998045 CEST	49735	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:52.550734043 CEST	49735	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:52.696180105 CEST	15409	49735	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:52.696350098 CEST	49735	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:52.839436054 CEST	15409	49735	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:53.028906107 CEST	15409	49735	3.129.187.220	192.168.2.3
Jun 11, 2021 05:38:53.142692089 CEST	49735	15409	192.168.2.3	3.129.187.220
Jun 11, 2021 05:38:53.197839975 CEST	15409	49735	3.129.187.220	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2021 05:37:48.970566988 CEST	60152	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:49.033849001 CEST	53	60152	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:49.378783941 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:49.442737103 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:50.145737886 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:50.204411983 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:51.442954063 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:51.495007992 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:52.702096939 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:52.764108896 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:53.692610025 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:53.744622946 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:54.623907089 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:54.686862946 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:55.696166039 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:55.749423981 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:57.883934021 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:57.939203024 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:58.812541962 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:37:58.863327980 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 11, 2021 05:37:59.996539116 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:00.055717945 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:01.384387016 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:01.443344116 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:02.852978945 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:02.913965940 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:03.809122086 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:03.860022068 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:04.636384010 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:04.686847925 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:05.487831116 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:05.538418055 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:06.414119005 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:06.464705944 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:07.609879017 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:07.670522928 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:08.449652910 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:08.513906956 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:28.096605062 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:28.160732031 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:28.208518982 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:28.271539927 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:34.836051941 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:34.896231890 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:37.599096060 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:37.659429073 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:40.598186016 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:40.660141945 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:43.438324928 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:43.497728109 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:46.221971035 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:46.285773993 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:49.135191917 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:49.196597099 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:52.318876028 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:52.380361080 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:55.058105946 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:55.119384050 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 11, 2021 05:38:57.808234930 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:38:57.862252951 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:01.317874908 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:01.382457972 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:04.265638113 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:04.324976921 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:07.983109951 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:08.038408041 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:10.783400059 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:10.845694065 CEST	53	52123	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:13.477179050 CEST	56130	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:13.538152933 CEST	53	56130	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:16.255187035 CEST	56338	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:16.316384077 CEST	53	56338	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:18.974092960 CEST	59420	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:19.033886909 CEST	53	59420	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:21.679620981 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:21.730010986 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:24.601767063 CEST	63978	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:24.661842108 CEST	53	63978	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:28.487149000 CEST	62938	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:28.546643972 CEST	53	62938	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:31.214534998 CEST	55708	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:31.275702953 CEST	53	55708	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:33.976038933 CEST	56803	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:34.036474943 CEST	53	56803	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:36.682391882 CEST	57145	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:36.741065979 CEST	53	57145	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:39.395881891 CEST	55359	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:39.457341909 CEST	53	55359	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:42.354665995 CEST	58306	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:42.414808989 CEST	53	58306	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:46.567203999 CEST	64124	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:46.626611948 CEST	53	64124	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:49.323838949 CEST	49361	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:49.382500887 CEST	53	49361	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:52.042948008 CEST	63150	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:52.093952894 CEST	53	63150	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:54.735972881 CEST	53279	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:54.798815012 CEST	53	53279	8.8.8.8	192.168.2.3
Jun 11, 2021 05:39:57.523766994 CEST	56881	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:39:57.577550888 CEST	53	56881	8.8.8.8	192.168.2.3
Jun 11, 2021 05:40:00.395754099 CEST	53642	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:40:00.449871063 CEST	53	53642	8.8.8.8	192.168.2.3
Jun 11, 2021 05:40:03.119240046 CEST	55667	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:40:03.181199074 CEST	53	55667	8.8.8.8	192.168.2.3
Jun 11, 2021 05:40:05.865139008 CEST	54833	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:40:05.927911043 CEST	53	54833	8.8.8.8	192.168.2.3
Jun 11, 2021 05:40:08.588099957 CEST	62476	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:40:08.651952982 CEST	53	62476	8.8.8.8	192.168.2.3
Jun 11, 2021 05:40:11.383903980 CEST	49705	53	192.168.2.3	8.8.8.8
Jun 11, 2021 05:40:11.447014093 CEST	53	49705	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 11, 2021 05:38:28.096605062 CEST	192.168.2.3	8.8.8.8	0xf277	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:34.836051941 CEST	192.168.2.3	8.8.8.8	0xb8e8	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:37.599096060 CEST	192.168.2.3	8.8.8.8	0xee6	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:40.598186016 CEST	192.168.2.3	8.8.8.8	0x32c4	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:43.438324928 CEST	192.168.2.3	8.8.8.8	0x38f4	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:46.221971035 CEST	192.168.2.3	8.8.8.8	0xe038	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:49.135191917 CEST	192.168.2.3	8.8.8.8	0xd1a8	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:52.318876028 CEST	192.168.2.3	8.8.8.8	0xf5b5	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:55.058105946 CEST	192.168.2.3	8.8.8.8	0x8c7d	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:57.808234930 CEST	192.168.2.3	8.8.8.8	0x921b	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:01.317874908 CEST	192.168.2.3	8.8.8.8	0xb963	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:04.265638113 CEST	192.168.2.3	8.8.8.8	0x118b	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:07.983109951 CEST	192.168.2.3	8.8.8.8	0xfb61	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:10.783400059 CEST	192.168.2.3	8.8.8.8	0xf912	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:13.477179050 CEST	192.168.2.3	8.8.8.8	0xfec0	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:16.255187035 CEST	192.168.2.3	8.8.8.8	0x4d5a	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:18.974092960 CEST	192.168.2.3	8.8.8.8	0xbd57	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:21.679620981 CEST	192.168.2.3	8.8.8.8	0x8ed1	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:24.601767063 CEST	192.168.2.3	8.8.8.8	0x8f77	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:28.487149000 CEST	192.168.2.3	8.8.8.8	0x847c	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:31.214534998 CEST	192.168.2.3	8.8.8.8	0xbb5f	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:33.976038933 CEST	192.168.2.3	8.8.8.8	0x53ca	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:36.682391882 CEST	192.168.2.3	8.8.8.8	0x91f6	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:39.395881891 CEST	192.168.2.3	8.8.8.8	0x87b1	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:42.354665995 CEST	192.168.2.3	8.8.8.8	0x6eba	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:46.567203999 CEST	192.168.2.3	8.8.8.8	0x9a26	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:49.323838949 CEST	192.168.2.3	8.8.8.8	0x5276	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:52.042948008 CEST	192.168.2.3	8.8.8.8	0xd7a2	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:54.735972881 CEST	192.168.2.3	8.8.8.8	0x6e44	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:57.523766994 CEST	192.168.2.3	8.8.8.8	0xafac	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:00.395754099 CEST	192.168.2.3	8.8.8.8	0x659c	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:03.119240046 CEST	192.168.2.3	8.8.8.8	0x7d9e	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:05.865139008 CEST	192.168.2.3	8.8.8.8	0xacb3	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:08.588099957 CEST	192.168.2.3	8.8.8.8	0x593e	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:11.383903980 CEST	192.168.2.3	8.8.8.8	0xc299	Standard query (0)	4.tcp.ngrok.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 11, 2021 05:38:28.160732031 CEST	8.8.8.8	192.168.2.3	0xf277	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:34.896231890 CEST	8.8.8.8	192.168.2.3	0xb8e8	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:37.659429073 CEST	8.8.8.8	192.168.2.3	0xee6	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:40.660141945 CEST	8.8.8.8	192.168.2.3	0x32c4	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:43.497728109 CEST	8.8.8.8	192.168.2.3	0x38f4	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:46.285773993 CEST	8.8.8.8	192.168.2.3	0xe038	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:49.196597099 CEST	8.8.8.8	192.168.2.3	0xd1a8	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:52.380361080 CEST	8.8.8.8	192.168.2.3	0xf5b5	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:55.119384050 CEST	8.8.8.8	192.168.2.3	0x8c7d	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:38:57.862252951 CEST	8.8.8.8	192.168.2.3	0x921b	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:01.382457972 CEST	8.8.8.8	192.168.2.3	0xb963	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:04.324976921 CEST	8.8.8.8	192.168.2.3	0x118b	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:08.038408041 CEST	8.8.8.8	192.168.2.3	0xfb61	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:10.845694065 CEST	8.8.8.8	192.168.2.3	0xf912	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:13.538152933 CEST	8.8.8.8	192.168.2.3	0xfec0	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:16.316384077 CEST	8.8.8.8	192.168.2.3	0x4d5a	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:19.033886909 CEST	8.8.8.8	192.168.2.3	0xbd57	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:21.730010986 CEST	8.8.8.8	192.168.2.3	0x8ed1	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:24.661842108 CEST	8.8.8.8	192.168.2.3	0x8f77	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:28.546643972 CEST	8.8.8.8	192.168.2.3	0x847c	No error (0)	4.tcp.ngrok.io	3.129.187.220	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:31.275702953 CEST	8.8.8.8	192.168.2.3	0xbb5f	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:34.036474943 CEST	8.8.8.8	192.168.2.3	0x53ca	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:36.741065979 CEST	8.8.8.8	192.168.2.3	0x91f6	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:39.457341909 CEST	8.8.8.8	192.168.2.3	0x87b1	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:42.414808989 CEST	8.8.8.8	192.168.2.3	0x6eba	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:46.626611948 CEST	8.8.8.8	192.168.2.3	0x9a26	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:49.382500887 CEST	8.8.8.8	192.168.2.3	0x5276	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:52.093952894 CEST	8.8.8.8	192.168.2.3	0xd7a2	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:54.798815012 CEST	8.8.8.8	192.168.2.3	0x6e44	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:39:57.577550888 CEST	8.8.8.8	192.168.2.3	0xafac	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:00.449871063 CEST	8.8.8.8	192.168.2.3	0x659c	No error (0)	4.tcp.ngrok.io	3.136.65.236	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:03.181199074 CEST	8.8.8.8	192.168.2.3	0x7d9e	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:05.927911043 CEST	8.8.8.8	192.168.2.3	0xacb3	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:08.651952982 CEST	8.8.8.8	192.168.2.3	0x593e	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)
Jun 11, 2021 05:40:11.447014093 CEST	8.8.8.8	192.168.2.3	0xc299	No error (0)	4.tcp.ngrok.io	3.138.180.119	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: XQehPgTn35.exe PID: 6468 Parent PID: 5836

General

Start time:	05:37:55
Start date:	11/06/2021
Path:	C:\Users\user\Desktop\XQehPgTn35.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\XQehPgTn35.exe'
Imagebase:	0xae0000
File size:	1143296 bytes
MD5 hash:	595C00BF9CA4BAA42B4490F2782CF2D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, Author: Joe Security Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.201103366.0000000000AE2000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: server.exe PID: 6616 Parent PID: 6468

General

Start time:	05:37:57
Start date:	11/06/2021
Path:	C:\Windows\server.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\server.exe'
Imagebase:	0x9c0000
File size:	1143296 bytes
MD5 hash:	595C00BF9CA4BAA42B4490F2782CF2D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Windows\server.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Analysis Process: netsh.exe PID: 6700 Parent PID: 6616

General

Start time:	05:38:00
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE
Imagebase:	0xd90000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6708 Parent PID: 6700

General

Start time:	05:38:00
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: netsh.exe PID: 3544 Parent PID: 6616

General

Start time:	05:38:17
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram 'C:\Windows\server.exe'
Imagebase:	0xd90000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6136 Parent PID: 3544

General

Start time:	05:38:18
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: netsh.exe PID: 5700 Parent PID: 6616

General

Start time:	05:38:18
Start date:	11/06/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram 'C:\Windows\server.exe' 'server.exe' ENABLE
Imagebase:	0xd90000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1740 Parent PID: 5700

General

Start time:	05:38:19
Start date:	11/06/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: Microsoft Corporation.exe PID: 5900 Parent PID: 3388

General

Start time:	05:38:21
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe'
Imagebase:	0xda0000
File size:	1143296 bytes
MD5 hash:	595C00BF9CA4BAA42B4490F2782CF2D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, Author: Joe Security Rule: Njrat, Description: detect njRAT in memory, Source: 0000000B.00000002.254123068.0000000000DA2000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 43%, Metadefender, Browse Detection: 62%, ReversingLabs
Reputation:	low

Analysis Process: Google.exe PID: 6716 Parent PID: 3388

General

Start time:	05:38:34
Start date:	11/06/2021
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Google.exe'
Imagebase:	0x1310000
File size:	1143296 bytes
MD5 hash:	595C00BF9CA4BAA42B4490F2782CF2D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, Author: Joe Security Rule: Njrat, Description: detect njRAT in memory, Source: 0000000E.00000002.286063064.0000000001312000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 43%, Metadefender, Browse Detection: 62%, ReversingLabs
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report XQehPgTn35.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Njrat

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre