Windows Analysis Report wREFu91LXZ.exe

Overview

General Information

Sample Name: wREFu91LXZ.exe
Analysis ID: 452405
MD5: 686dc98567009e47eac88e95804b9dde
SHA1: 5788c30289d12f69d5cf323049d8d3c3a3e73cda
SHA256: 11d84c7f9c579c2e58f4acc04d488d5f1c6cc0439609099eabec42444f5ef952
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.extinctionbrews.com/dy8g/"], "decoy": ["mzyxi-rkah-y.net", "okinawarongnho.com", "qq66520.com", "nimbus.watch", "cwdelrio.com", "regalshopper.com", "avito-payment.life", "jorgeporcayo.com", "galvinsky.digital", "guys-only.com", "asmfruits-almacenes.com", "boatrace-life04.net", "cochez.club", "thelastvictor.net", "janieleconte.com", "ivoirepneus.com", "saludflv.info", "mydreamtv.net", "austinphy.com", "cajunseafoodstcloud.com", "13006608192.com", "clear3media.com", "thegrowclinic.com", "findfoodshop.com", "livegaming.store", "greensei.com", "atmaapothecary.com", "builtbydawn.com", "wthcoffee.com", "melodezu.com", "oikoschain.com", "matcitekids.com", "killrstudio.com", "doityourselfism.com", "monsoonnerd.com", "swissbankmusic.com", "envisionfordheights.com", "invisiongc.net", "aizaibali.com", "professioneconsulenza.net", "chaneabond.com", "theamercianhouseboat.com", "scuolatua.com", "surivaganza.com", "xn--vuq722jwngjre.com", "quiteimediato.space", "ecofingers.com", "manageoceanaccount.com", "cindywillardrealtor.com", "garimpeirastore.online", "tinsley.website", "fitnesstwentytwenty.com", "thenorthgoldline.com", "scuolacounselingroma.com", "iwccgroup.com", "wideawakemomma.com", "anthonysavillemiddleschool.com", "sprinkleresources.com", "ravexim3.com", "onedadtwodudes.com", "shxytl.com", "iriscloudvideo.com", "theshapecreator.com", "vermogenswerte.com"]}
Multi AV Scanner detection for submitted file
Source: wREFu91LXZ.exe Virustotal: Detection: 31% Perma Link
Source: wREFu91LXZ.exe ReversingLabs: Detection: 53%
Yara detected FormBook
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Machine Learning detection for sample
Source: wREFu91LXZ.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 10.2.msiexec.exe.48c7960.5.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 10.2.msiexec.exe.22b358.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.wREFu91LXZ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.1.wREFu91LXZ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.wREFu91LXZ.exe.680000.1.unpack Avira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Uses 32bit PE files
Source: wREFu91LXZ.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: Binary string: msiexec.pdb source: wREFu91LXZ.exe, 00000003.00000002.284421615.0000000000A40000.00000040.00000001.sdmp
Source: Binary string: msiexec.pdbGCTL source: wREFu91LXZ.exe, 00000003.00000002.284421615.0000000000A40000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: wREFu91LXZ.exe, 00000001.00000003.226799711.0000000002330000.00000004.00000001.sdmp, wREFu91LXZ.exe, 00000003.00000002.284645298.0000000000C2F000.00000040.00000001.sdmp, msiexec.exe, 0000000A.00000002.487880611.0000000004390000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: wREFu91LXZ.exe, msiexec.exe

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 4x nop then pop esi 3_2_00415852
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 4x nop then pop ebx 3_2_00406A98
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 4x nop then pop edi 3_2_00415699
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then pop ebx 10_2_02A16A99
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then pop esi 10_2_02A25852
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 4x nop then pop edi 10_2_02A25699

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 52.5.43.61:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 52.5.43.61:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49737 -> 52.5.43.61:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49739 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49739 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49739 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 50.87.238.189:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 50.87.238.189:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49741 -> 50.87.238.189:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 50.87.248.20:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 50.87.248.20:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 50.87.248.20:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.extinctionbrews.com/dy8g/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=0Hs+m/QFKKZkFwACjLHyI7vfWqidr4y2jXRg5Hngc5JW+skIzqaHxis+6ShLP6A0B+d4&sxlxj=RL30W HTTP/1.1Host: www.chaneabond.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=qBaU/+yfeYHlIZouGPofXU4iidVfFInHYvrLlGgOmZTTl18u/I/MgAYEWpA7pfREgQYT&sxlxj=RL30W HTTP/1.1Host: www.melodezu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=sC7FhjJqcCFIEoUuEobIBnrRYwOZzG9nc/x6jFk5Keq5TgsKgOpKFfaz6JoBJPzzv7cu&sxlxj=RL30W HTTP/1.1Host: www.cajunseafoodstcloud.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoFjnAjbDmWUu&sxlxj=RL30W HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=iVPDfBhYBy5JvywJlu7/jTaNaIK/WCHUrbFXeojMH/nMVdHPbpxjQuq5aGN6jhO1pTuT&sxlxj=RL30W HTTP/1.1Host: www.tinsley.websiteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=XQ+IsuOG6xtA2RDWfBD5IRfVZekOdoA9gy19PVXp7eWYHk3qJ48ISdkxrcmrsJaPDNZD&sxlxj=RL30W HTTP/1.1Host: www.surivaganza.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=dI9eO6GEnVuhhF2IZBGZI9CJMc/scmM0Fs5NmUifzPq1VUdHCmcaYQjC6cJJVTF2eMwa&sxlxj=RL30W HTTP/1.1Host: www.matcitekids.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.185.159.144 198.185.159.144
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=0Hs+m/QFKKZkFwACjLHyI7vfWqidr4y2jXRg5Hngc5JW+skIzqaHxis+6ShLP6A0B+d4&sxlxj=RL30W HTTP/1.1Host: www.chaneabond.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=qBaU/+yfeYHlIZouGPofXU4iidVfFInHYvrLlGgOmZTTl18u/I/MgAYEWpA7pfREgQYT&sxlxj=RL30W HTTP/1.1Host: www.melodezu.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=sC7FhjJqcCFIEoUuEobIBnrRYwOZzG9nc/x6jFk5Keq5TgsKgOpKFfaz6JoBJPzzv7cu&sxlxj=RL30W HTTP/1.1Host: www.cajunseafoodstcloud.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoFjnAjbDmWUu&sxlxj=RL30W HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=iVPDfBhYBy5JvywJlu7/jTaNaIK/WCHUrbFXeojMH/nMVdHPbpxjQuq5aGN6jhO1pTuT&sxlxj=RL30W HTTP/1.1Host: www.tinsley.websiteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=XQ+IsuOG6xtA2RDWfBD5IRfVZekOdoA9gy19PVXp7eWYHk3qJ48ISdkxrcmrsJaPDNZD&sxlxj=RL30W HTTP/1.1Host: www.surivaganza.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?9rrLUp1=dI9eO6GEnVuhhF2IZBGZI9CJMc/scmM0Fs5NmUifzPq1VUdHCmcaYQjC6cJJVTF2eMwa&sxlxj=RL30W HTTP/1.1Host: www.matcitekids.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.chaneabond.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 08:09:41 GMTServer: Apache/2.4.18 (Ubuntu)Content-Length: 278Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 6d 65 6c 6f 64 65 7a 75 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at www.melodezu.com Port 80</address></body></html>
Source: explorer.exe, 00000005.00000000.248833107.0000000008A3A000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.248948750.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004181D0 NtCreateFile, 3_2_004181D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00418280 NtReadFile, 3_2_00418280
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00418300 NtClose, 3_2_00418300
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004183B0 NtAllocateVirtualMemory, 3_2_004183B0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00418222 NtCreateFile, 3_2_00418222
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004183AA NtAllocateVirtualMemory, 3_2_004183AA
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B798F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_00B798F0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_00B79860
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79840 NtDelayExecution,LdrInitializeThunk, 3_2_00B79840
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B799A0 NtCreateSection,LdrInitializeThunk, 3_2_00B799A0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_00B79910
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79A20 NtResumeThread,LdrInitializeThunk, 3_2_00B79A20
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_00B79A00
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79A50 NtCreateFile,LdrInitializeThunk, 3_2_00B79A50
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B795D0 NtClose,LdrInitializeThunk, 3_2_00B795D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79540 NtReadFile,LdrInitializeThunk, 3_2_00B79540
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B796E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_00B796E0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_00B79660
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B797A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_00B797A0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79780 NtMapViewOfSection,LdrInitializeThunk, 3_2_00B79780
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79FE0 NtCreateMutant,LdrInitializeThunk, 3_2_00B79FE0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79710 NtQueryInformationToken,LdrInitializeThunk, 3_2_00B79710
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B798A0 NtWriteVirtualMemory, 3_2_00B798A0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79820 NtEnumerateKey, 3_2_00B79820
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B7B040 NtSuspendThread, 3_2_00B7B040
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B799D0 NtCreateProcessEx, 3_2_00B799D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79950 NtQueueApcThread, 3_2_00B79950
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79A80 NtOpenDirectoryObject, 3_2_00B79A80
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B79A10 NtQuerySection, 3_2_00B79A10
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B7A3B0 NtGetContextThread, 3_2_00B7A3B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_043F9860
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9840 NtDelayExecution,LdrInitializeThunk, 10_2_043F9840
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_043F9910
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9540 NtReadFile,LdrInitializeThunk, 10_2_043F9540
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F99A0 NtCreateSection,LdrInitializeThunk, 10_2_043F99A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F95D0 NtClose,LdrInitializeThunk, 10_2_043F95D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_043F9660
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9A50 NtCreateFile,LdrInitializeThunk, 10_2_043F9A50
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9650 NtQueryValueKey,LdrInitializeThunk, 10_2_043F9650
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_043F96E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F96D0 NtCreateKey,LdrInitializeThunk, 10_2_043F96D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9710 NtQueryInformationToken,LdrInitializeThunk, 10_2_043F9710
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9780 NtMapViewOfSection,LdrInitializeThunk, 10_2_043F9780
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9FE0 NtCreateMutant,LdrInitializeThunk, 10_2_043F9FE0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9820 NtEnumerateKey, 10_2_043F9820
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043FB040 NtSuspendThread, 10_2_043FB040
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F98A0 NtWriteVirtualMemory, 10_2_043F98A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F98F0 NtReadVirtualMemory, 10_2_043F98F0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043FAD30 NtSetContextThread, 10_2_043FAD30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9520 NtWaitForSingleObject, 10_2_043F9520
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9560 NtWriteFile, 10_2_043F9560
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9950 NtQueueApcThread, 10_2_043F9950
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F95F0 NtQueryInformationFile, 10_2_043F95F0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F99D0 NtCreateProcessEx, 10_2_043F99D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9A20 NtResumeThread, 10_2_043F9A20
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9610 NtEnumerateValueKey, 10_2_043F9610
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9A10 NtQuerySection, 10_2_043F9A10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9A00 NtProtectVirtualMemory, 10_2_043F9A00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9670 NtQueryInformationProcess, 10_2_043F9670
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9A80 NtOpenDirectoryObject, 10_2_043F9A80
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9730 NtQueryVirtualMemory, 10_2_043F9730
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043FA710 NtOpenProcessToken, 10_2_043FA710
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9B00 NtSetValueKey, 10_2_043F9B00
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9770 NtSetInformationFile, 10_2_043F9770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043FA770 NtOpenThread, 10_2_043FA770
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F9760 NtOpenProcess, 10_2_043F9760
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043FA3B0 NtGetContextThread, 10_2_043FA3B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F97A0 NtUnmapViewOfSection, 10_2_043F97A0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A28280 NtReadFile, 10_2_02A28280
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A283B0 NtAllocateVirtualMemory, 10_2_02A283B0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A28300 NtClose, 10_2_02A28300
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A281D0 NtCreateFile, 10_2_02A281D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A28222 NtCreateFile, 10_2_02A28222
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A283AA NtAllocateVirtualMemory, 10_2_02A283AA
Detected potential crypto function
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0040102E 3_2_0040102E
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B8FB 3_2_0041B8FB
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00408C6C 3_2_00408C6C
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00408C70 3_2_00408C70
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B57A 3_2_0041B57A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00402D88 3_2_00402D88
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041C58A 3_2_0041C58A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4B090 3_2_00B4B090
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BF1002 3_2_00BF1002
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3F900 3_2_00B3F900
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6EBB0 3_2_00B6EBB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C841F 10_2_043C841F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471002 10_2_04471002
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CB090 10_2_043CB090
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B0D20 10_2_043B0D20
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04481D55 10_2_04481D55
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BF900 10_2_043BF900
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D6E30 10_2_043D6E30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EEBB0 10_2_043EEBB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B8FB 10_2_02A2B8FB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A12FB0 10_2_02A12FB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A18C6C 10_2_02A18C6C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A18C70 10_2_02A18C70
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2C58A 10_2_02A2C58A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A12D88 10_2_02A12D88
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A12D90 10_2_02A12D90
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B57A 10_2_02A2B57A
Sample file is different than original file name gathered from version info
Source: wREFu91LXZ.exe, 00000001.00000003.227334681.000000000263F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs wREFu91LXZ.exe
Source: wREFu91LXZ.exe, 00000003.00000002.284453440.0000000000A4F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamemsiexec.exeX vs wREFu91LXZ.exe
Source: wREFu91LXZ.exe, 00000003.00000002.284645298.0000000000C2F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs wREFu91LXZ.exe
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Uses 32bit PE files
Source: wREFu91LXZ.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Yara signature match
Source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/0@12/7
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_01
Source: wREFu91LXZ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: wREFu91LXZ.exe Virustotal: Detection: 31%
Source: wREFu91LXZ.exe ReversingLabs: Detection: 53%
Source: C:\Users\user\Desktop\wREFu91LXZ.exe File read: C:\Users\user\Desktop\wREFu91LXZ.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\wREFu91LXZ.exe 'C:\Users\user\Desktop\wREFu91LXZ.exe'
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process created: C:\Users\user\Desktop\wREFu91LXZ.exe 'C:\Users\user\Desktop\wREFu91LXZ.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\wREFu91LXZ.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process created: C:\Users\user\Desktop\wREFu91LXZ.exe 'C:\Users\user\Desktop\wREFu91LXZ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\wREFu91LXZ.exe' Jump to behavior
Source: Binary string: msiexec.pdb source: wREFu91LXZ.exe, 00000003.00000002.284421615.0000000000A40000.00000040.00000001.sdmp
Source: Binary string: msiexec.pdbGCTL source: wREFu91LXZ.exe, 00000003.00000002.284421615.0000000000A40000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: wREFu91LXZ.exe, 00000001.00000003.226799711.0000000002330000.00000004.00000001.sdmp, wREFu91LXZ.exe, 00000003.00000002.284645298.0000000000C2F000.00000040.00000001.sdmp, msiexec.exe, 0000000A.00000002.487880611.0000000004390000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: wREFu91LXZ.exe, msiexec.exe

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Unpacked PE file: 3.2.wREFu91LXZ.exe.400000.0.unpack .text:ER;.rdata:R; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004062F6 pushfd ; ret 3_2_004062F7
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B3C5 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004153FC push eax; retf 3_2_0041540B
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B47C push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B412 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041B41B push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00415CE7 pushad ; ret 3_2_00415D4B
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_0041C4EE push 133511A3h; retf 3_2_0041C4F3
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00414D71 push ss; iretd 3_2_00414D72
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00415D38 pushad ; ret 3_2_00415D4B
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B8D0D1 push ecx; ret 3_2_00B8D0E4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0440D0D1 push ecx; ret 10_2_0440D0E4
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A162F6 pushfd ; ret 10_2_02A162F7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A253FC push eax; retf 10_2_02A2540B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B3C5 push eax; ret 10_2_02A2B418
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A25CE7 pushad ; ret 10_2_02A25D4B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2C4EE push 133511A3h; retf 10_2_02A2C4F3
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B412 push eax; ret 10_2_02A2B418
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B41B push eax; ret 10_2_02A2B482
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A2B47C push eax; ret 10_2_02A2B482
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A25D38 pushad ; ret 10_2_02A25D4B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_02A24D71 push ss; iretd 10_2_02A24D72
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\wREFu91LXZ.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\wREFu91LXZ.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe RDTSC instruction interceptor: First address: 0000000002A185F4 second address: 0000000002A185FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe RDTSC instruction interceptor: First address: 0000000002A1898E second address: 0000000002A18994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 5224 Thread sleep time: -45000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1332 Thread sleep time: -46000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe Last function: Thread delayed
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.246941784.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.247439928.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.270829033.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.247849993.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000000.270872903.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000005.00000000.246941784.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.246941784.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.240221570.0000000004E61000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oft.Mic
Source: explorer.exe, 00000005.00000000.248432954.0000000008907000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA_CD00#5&r
Source: explorer.exe, 00000005.00000000.246941784.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00409B30 LdrLoadDll, 3_2_00409B30
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 1_2_021906DA mov eax, dword ptr fs:[00000030h] 1_2_021906DA
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 1_2_02190A1C mov eax, dword ptr fs:[00000030h] 1_2_02190A1C
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 1_2_0219099F mov eax, dword ptr fs:[00000030h] 1_2_0219099F
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 1_2_021909DE mov eax, dword ptr fs:[00000030h] 1_2_021909DE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 1_2_021908EE mov eax, dword ptr fs:[00000030h] 1_2_021908EE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6F0BF mov ecx, dword ptr fs:[00000030h] 3_2_00B6F0BF
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6F0BF mov eax, dword ptr fs:[00000030h] 3_2_00B6F0BF
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6F0BF mov eax, dword ptr fs:[00000030h] 3_2_00B6F0BF
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B790AF mov eax, dword ptr fs:[00000030h] 3_2_00B790AF
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39080 mov eax, dword ptr fs:[00000030h] 3_2_00B39080
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB3884 mov eax, dword ptr fs:[00000030h] 3_2_00BB3884
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB3884 mov eax, dword ptr fs:[00000030h] 3_2_00BB3884
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov ecx, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BCB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00BCB8D0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6002D mov eax, dword ptr fs:[00000030h] 3_2_00B6002D
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6002D mov eax, dword ptr fs:[00000030h] 3_2_00B6002D
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6002D mov eax, dword ptr fs:[00000030h] 3_2_00B6002D
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6002D mov eax, dword ptr fs:[00000030h] 3_2_00B6002D
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6002D mov eax, dword ptr fs:[00000030h] 3_2_00B6002D
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4B02A mov eax, dword ptr fs:[00000030h] 3_2_00B4B02A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4B02A mov eax, dword ptr fs:[00000030h] 3_2_00B4B02A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4B02A mov eax, dword ptr fs:[00000030h] 3_2_00B4B02A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4B02A mov eax, dword ptr fs:[00000030h] 3_2_00B4B02A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB7016 mov eax, dword ptr fs:[00000030h] 3_2_00BB7016
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB7016 mov eax, dword ptr fs:[00000030h] 3_2_00BB7016
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB7016 mov eax, dword ptr fs:[00000030h] 3_2_00BB7016
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00C01074 mov eax, dword ptr fs:[00000030h] 3_2_00C01074
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BF2073 mov eax, dword ptr fs:[00000030h] 3_2_00BF2073
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00C04015 mov eax, dword ptr fs:[00000030h] 3_2_00C04015
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00C04015 mov eax, dword ptr fs:[00000030h] 3_2_00C04015
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B50050 mov eax, dword ptr fs:[00000030h] 3_2_00B50050
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B50050 mov eax, dword ptr fs:[00000030h] 3_2_00B50050
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB51BE mov eax, dword ptr fs:[00000030h] 3_2_00BB51BE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB51BE mov eax, dword ptr fs:[00000030h] 3_2_00BB51BE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB51BE mov eax, dword ptr fs:[00000030h] 3_2_00BB51BE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB51BE mov eax, dword ptr fs:[00000030h] 3_2_00BB51BE
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B661A0 mov eax, dword ptr fs:[00000030h] 3_2_00B661A0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B661A0 mov eax, dword ptr fs:[00000030h] 3_2_00B661A0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BB69A6 mov eax, dword ptr fs:[00000030h] 3_2_00BB69A6
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B62990 mov eax, dword ptr fs:[00000030h] 3_2_00B62990
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6A185 mov eax, dword ptr fs:[00000030h] 3_2_00B6A185
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B5C182 mov eax, dword ptr fs:[00000030h] 3_2_00B5C182
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B3B1E1
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B3B1E1
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00B3B1E1
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BC41E8 mov eax, dword ptr fs:[00000030h] 3_2_00BC41E8
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6513A mov eax, dword ptr fs:[00000030h] 3_2_00B6513A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6513A mov eax, dword ptr fs:[00000030h] 3_2_00B6513A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 mov eax, dword ptr fs:[00000030h] 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 mov eax, dword ptr fs:[00000030h] 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 mov eax, dword ptr fs:[00000030h] 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 mov eax, dword ptr fs:[00000030h] 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B54120 mov ecx, dword ptr fs:[00000030h] 3_2_00B54120
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39100 mov eax, dword ptr fs:[00000030h] 3_2_00B39100
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39100 mov eax, dword ptr fs:[00000030h] 3_2_00B39100
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39100 mov eax, dword ptr fs:[00000030h] 3_2_00B39100
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3B171 mov eax, dword ptr fs:[00000030h] 3_2_00B3B171
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3B171 mov eax, dword ptr fs:[00000030h] 3_2_00B3B171
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3C962 mov eax, dword ptr fs:[00000030h] 3_2_00B3C962
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B5B944 mov eax, dword ptr fs:[00000030h] 3_2_00B5B944
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B5B944 mov eax, dword ptr fs:[00000030h] 3_2_00B5B944
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B4AAB0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B4AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B4AAB0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6FAB0 mov eax, dword ptr fs:[00000030h] 3_2_00B6FAB0
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B352A5 mov eax, dword ptr fs:[00000030h] 3_2_00B352A5
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B352A5 mov eax, dword ptr fs:[00000030h] 3_2_00B352A5
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B352A5 mov eax, dword ptr fs:[00000030h] 3_2_00B352A5
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B352A5 mov eax, dword ptr fs:[00000030h] 3_2_00B352A5
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B352A5 mov eax, dword ptr fs:[00000030h] 3_2_00B352A5
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6D294 mov eax, dword ptr fs:[00000030h] 3_2_00B6D294
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6D294 mov eax, dword ptr fs:[00000030h] 3_2_00B6D294
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B62AE4 mov eax, dword ptr fs:[00000030h] 3_2_00B62AE4
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B62ACB mov eax, dword ptr fs:[00000030h] 3_2_00B62ACB
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00C08A62 mov eax, dword ptr fs:[00000030h] 3_2_00C08A62
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B3AA16
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B3AA16 mov eax, dword ptr fs:[00000030h] 3_2_00B3AA16
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B53A1C mov eax, dword ptr fs:[00000030h] 3_2_00B53A1C
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B48A0A mov eax, dword ptr fs:[00000030h] 3_2_00B48A0A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B7927A mov eax, dword ptr fs:[00000030h] 3_2_00B7927A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BEB260 mov eax, dword ptr fs:[00000030h] 3_2_00BEB260
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BEB260 mov eax, dword ptr fs:[00000030h] 3_2_00BEB260
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BC4257 mov eax, dword ptr fs:[00000030h] 3_2_00BC4257
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39240 mov eax, dword ptr fs:[00000030h] 3_2_00B39240
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39240 mov eax, dword ptr fs:[00000030h] 3_2_00B39240
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39240 mov eax, dword ptr fs:[00000030h] 3_2_00B39240
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B39240 mov eax, dword ptr fs:[00000030h] 3_2_00B39240
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B6B390 mov eax, dword ptr fs:[00000030h] 3_2_00B6B390
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BF138A mov eax, dword ptr fs:[00000030h] 3_2_00BF138A
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B41B8F mov eax, dword ptr fs:[00000030h] 3_2_00B41B8F
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B41B8F mov eax, dword ptr fs:[00000030h] 3_2_00B41B8F
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00BED380 mov ecx, dword ptr fs:[00000030h] 3_2_00BED380
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Code function: 3_2_00B603E2 mov eax, dword ptr fs:[00000030h] 3_2_00B603E2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EBC2C mov eax, dword ptr fs:[00000030h] 10_2_043EBC2C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444C450 mov eax, dword ptr fs:[00000030h] 10_2_0444C450
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444C450 mov eax, dword ptr fs:[00000030h] 10_2_0444C450
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CB02A mov eax, dword ptr fs:[00000030h] 10_2_043CB02A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CB02A mov eax, dword ptr fs:[00000030h] 10_2_043CB02A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CB02A mov eax, dword ptr fs:[00000030h] 10_2_043CB02A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CB02A mov eax, dword ptr fs:[00000030h] 10_2_043CB02A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04472073 mov eax, dword ptr fs:[00000030h] 10_2_04472073
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04481074 mov eax, dword ptr fs:[00000030h] 10_2_04481074
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04471C06 mov eax, dword ptr fs:[00000030h] 10_2_04471C06
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0448740D mov eax, dword ptr fs:[00000030h] 10_2_0448740D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0448740D mov eax, dword ptr fs:[00000030h] 10_2_0448740D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0448740D mov eax, dword ptr fs:[00000030h] 10_2_0448740D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436C0A mov eax, dword ptr fs:[00000030h] 10_2_04436C0A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436C0A mov eax, dword ptr fs:[00000030h] 10_2_04436C0A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436C0A mov eax, dword ptr fs:[00000030h] 10_2_04436C0A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436C0A mov eax, dword ptr fs:[00000030h] 10_2_04436C0A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D746D mov eax, dword ptr fs:[00000030h] 10_2_043D746D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437016 mov eax, dword ptr fs:[00000030h] 10_2_04437016
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437016 mov eax, dword ptr fs:[00000030h] 10_2_04437016
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437016 mov eax, dword ptr fs:[00000030h] 10_2_04437016
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04484015 mov eax, dword ptr fs:[00000030h] 10_2_04484015
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04484015 mov eax, dword ptr fs:[00000030h] 10_2_04484015
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D0050 mov eax, dword ptr fs:[00000030h] 10_2_043D0050
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D0050 mov eax, dword ptr fs:[00000030h] 10_2_043D0050
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EF0BF mov ecx, dword ptr fs:[00000030h] 10_2_043EF0BF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EF0BF mov eax, dword ptr fs:[00000030h] 10_2_043EF0BF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EF0BF mov eax, dword ptr fs:[00000030h] 10_2_043EF0BF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F90AF mov eax, dword ptr fs:[00000030h] 10_2_043F90AF
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0444B8D0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488CD6 mov eax, dword ptr fs:[00000030h] 10_2_04488CD6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436CF0 mov eax, dword ptr fs:[00000030h] 10_2_04436CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436CF0 mov eax, dword ptr fs:[00000030h] 10_2_04436CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04436CF0 mov eax, dword ptr fs:[00000030h] 10_2_04436CF0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9080 mov eax, dword ptr fs:[00000030h] 10_2_043B9080
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_044714FB mov eax, dword ptr fs:[00000030h] 10_2_044714FB
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04433884 mov eax, dword ptr fs:[00000030h] 10_2_04433884
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04433884 mov eax, dword ptr fs:[00000030h] 10_2_04433884
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04433540 mov eax, dword ptr fs:[00000030h] 10_2_04433540
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E513A mov eax, dword ptr fs:[00000030h] 10_2_043E513A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E513A mov eax, dword ptr fs:[00000030h] 10_2_043E513A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E4D3B mov eax, dword ptr fs:[00000030h] 10_2_043E4D3B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E4D3B mov eax, dword ptr fs:[00000030h] 10_2_043E4D3B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E4D3B mov eax, dword ptr fs:[00000030h] 10_2_043E4D3B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C3D34 mov eax, dword ptr fs:[00000030h] 10_2_043C3D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BAD30 mov eax, dword ptr fs:[00000030h] 10_2_043BAD30
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 mov eax, dword ptr fs:[00000030h] 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 mov eax, dword ptr fs:[00000030h] 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 mov eax, dword ptr fs:[00000030h] 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 mov eax, dword ptr fs:[00000030h] 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D4120 mov ecx, dword ptr fs:[00000030h] 10_2_043D4120
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9100 mov eax, dword ptr fs:[00000030h] 10_2_043B9100
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9100 mov eax, dword ptr fs:[00000030h] 10_2_043B9100
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9100 mov eax, dword ptr fs:[00000030h] 10_2_043B9100
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BB171 mov eax, dword ptr fs:[00000030h] 10_2_043BB171
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BB171 mov eax, dword ptr fs:[00000030h] 10_2_043BB171
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DC577 mov eax, dword ptr fs:[00000030h] 10_2_043DC577
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DC577 mov eax, dword ptr fs:[00000030h] 10_2_043DC577
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D7D50 mov eax, dword ptr fs:[00000030h] 10_2_043D7D50
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0443A537 mov eax, dword ptr fs:[00000030h] 10_2_0443A537
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DB944 mov eax, dword ptr fs:[00000030h] 10_2_043DB944
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DB944 mov eax, dword ptr fs:[00000030h] 10_2_043DB944
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488D34 mov eax, dword ptr fs:[00000030h] 10_2_04488D34
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F3D43 mov eax, dword ptr fs:[00000030h] 10_2_043F3D43
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E35A1 mov eax, dword ptr fs:[00000030h] 10_2_043E35A1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EFD9B mov eax, dword ptr fs:[00000030h] 10_2_043EFD9B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EFD9B mov eax, dword ptr fs:[00000030h] 10_2_043EFD9B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B2D8A mov eax, dword ptr fs:[00000030h] 10_2_043B2D8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B2D8A mov eax, dword ptr fs:[00000030h] 10_2_043B2D8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B2D8A mov eax, dword ptr fs:[00000030h] 10_2_043B2D8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B2D8A mov eax, dword ptr fs:[00000030h] 10_2_043B2D8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B2D8A mov eax, dword ptr fs:[00000030h] 10_2_043B2D8A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04468DF1 mov eax, dword ptr fs:[00000030h] 10_2_04468DF1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EA185 mov eax, dword ptr fs:[00000030h] 10_2_043EA185
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DC182 mov eax, dword ptr fs:[00000030h] 10_2_043DC182
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BB1E1 mov eax, dword ptr fs:[00000030h] 10_2_043BB1E1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BB1E1 mov eax, dword ptr fs:[00000030h] 10_2_043BB1E1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BB1E1 mov eax, dword ptr fs:[00000030h] 10_2_043BB1E1
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BE620 mov eax, dword ptr fs:[00000030h] 10_2_043BE620
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043D3A1C mov eax, dword ptr fs:[00000030h] 10_2_043D3A1C
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0446B260 mov eax, dword ptr fs:[00000030h] 10_2_0446B260
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0446B260 mov eax, dword ptr fs:[00000030h] 10_2_0446B260
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488A62 mov eax, dword ptr fs:[00000030h] 10_2_04488A62
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BC600 mov eax, dword ptr fs:[00000030h] 10_2_043BC600
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BC600 mov eax, dword ptr fs:[00000030h] 10_2_043BC600
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BC600 mov eax, dword ptr fs:[00000030h] 10_2_043BC600
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F927A mov eax, dword ptr fs:[00000030h] 10_2_043F927A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DAE73 mov eax, dword ptr fs:[00000030h] 10_2_043DAE73
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DAE73 mov eax, dword ptr fs:[00000030h] 10_2_043DAE73
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DAE73 mov eax, dword ptr fs:[00000030h] 10_2_043DAE73
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DAE73 mov eax, dword ptr fs:[00000030h] 10_2_043DAE73
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043DAE73 mov eax, dword ptr fs:[00000030h] 10_2_043DAE73
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C766D mov eax, dword ptr fs:[00000030h] 10_2_043C766D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0446FE3F mov eax, dword ptr fs:[00000030h] 10_2_0446FE3F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9240 mov eax, dword ptr fs:[00000030h] 10_2_043B9240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9240 mov eax, dword ptr fs:[00000030h] 10_2_043B9240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9240 mov eax, dword ptr fs:[00000030h] 10_2_043B9240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B9240 mov eax, dword ptr fs:[00000030h] 10_2_043B9240
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C7E41 mov eax, dword ptr fs:[00000030h] 10_2_043C7E41
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0446FEC0 mov eax, dword ptr fs:[00000030h] 10_2_0446FEC0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CAAB0 mov eax, dword ptr fs:[00000030h] 10_2_043CAAB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CAAB0 mov eax, dword ptr fs:[00000030h] 10_2_043CAAB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EFAB0 mov eax, dword ptr fs:[00000030h] 10_2_043EFAB0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B52A5 mov eax, dword ptr fs:[00000030h] 10_2_043B52A5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B52A5 mov eax, dword ptr fs:[00000030h] 10_2_043B52A5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B52A5 mov eax, dword ptr fs:[00000030h] 10_2_043B52A5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B52A5 mov eax, dword ptr fs:[00000030h] 10_2_043B52A5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B52A5 mov eax, dword ptr fs:[00000030h] 10_2_043B52A5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488ED6 mov eax, dword ptr fs:[00000030h] 10_2_04488ED6
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043ED294 mov eax, dword ptr fs:[00000030h] 10_2_043ED294
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043ED294 mov eax, dword ptr fs:[00000030h] 10_2_043ED294
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444FE87 mov eax, dword ptr fs:[00000030h] 10_2_0444FE87
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E16E0 mov ecx, dword ptr fs:[00000030h] 10_2_043E16E0
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C76E2 mov eax, dword ptr fs:[00000030h] 10_2_043C76E2
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_044346A7 mov eax, dword ptr fs:[00000030h] 10_2_044346A7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04480EA5 mov eax, dword ptr fs:[00000030h] 10_2_04480EA5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04480EA5 mov eax, dword ptr fs:[00000030h] 10_2_04480EA5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04480EA5 mov eax, dword ptr fs:[00000030h] 10_2_04480EA5
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E36CC mov eax, dword ptr fs:[00000030h] 10_2_043E36CC
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043F8EC7 mov eax, dword ptr fs:[00000030h] 10_2_043F8EC7
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EE730 mov eax, dword ptr fs:[00000030h] 10_2_043EE730
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488B58 mov eax, dword ptr fs:[00000030h] 10_2_04488B58
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B4F2E mov eax, dword ptr fs:[00000030h] 10_2_043B4F2E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043B4F2E mov eax, dword ptr fs:[00000030h] 10_2_043B4F2E
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04488F6A mov eax, dword ptr fs:[00000030h] 10_2_04488F6A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E3B7A mov eax, dword ptr fs:[00000030h] 10_2_043E3B7A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043E3B7A mov eax, dword ptr fs:[00000030h] 10_2_043E3B7A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0448070D mov eax, dword ptr fs:[00000030h] 10_2_0448070D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0448070D mov eax, dword ptr fs:[00000030h] 10_2_0448070D
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444FF10 mov eax, dword ptr fs:[00000030h] 10_2_0444FF10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0444FF10 mov eax, dword ptr fs:[00000030h] 10_2_0444FF10
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BDB60 mov ecx, dword ptr fs:[00000030h] 10_2_043BDB60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0447131B mov eax, dword ptr fs:[00000030h] 10_2_0447131B
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CFF60 mov eax, dword ptr fs:[00000030h] 10_2_043CFF60
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BF358 mov eax, dword ptr fs:[00000030h] 10_2_043BF358
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043BDB40 mov eax, dword ptr fs:[00000030h] 10_2_043BDB40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043CEF40 mov eax, dword ptr fs:[00000030h] 10_2_043CEF40
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043EB390 mov eax, dword ptr fs:[00000030h] 10_2_043EB390
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C1B8F mov eax, dword ptr fs:[00000030h] 10_2_043C1B8F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_043C1B8F mov eax, dword ptr fs:[00000030h] 10_2_043C1B8F
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0446D380 mov ecx, dword ptr fs:[00000030h] 10_2_0446D380
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_0447138A mov eax, dword ptr fs:[00000030h] 10_2_0447138A
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437794 mov eax, dword ptr fs:[00000030h] 10_2_04437794
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437794 mov eax, dword ptr fs:[00000030h] 10_2_04437794
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04437794 mov eax, dword ptr fs:[00000030h] 10_2_04437794
Source: C:\Windows\SysWOW64\msiexec.exe Code function: 10_2_04485BA5 mov eax, dword ptr fs:[00000030h] 10_2_04485BA5
Enables debug privileges
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.surivaganza.com
Source: C:\Windows\explorer.exe Network Connect: 52.5.43.61 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.oikoschain.com
Source: C:\Windows\explorer.exe Domain query: www.matcitekids.com
Source: C:\Windows\explorer.exe Network Connect: 50.87.248.20 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.chaneabond.com
Source: C:\Windows\explorer.exe Domain query: www.extinctionbrews.com
Source: C:\Windows\explorer.exe Domain query: www.monsoonnerd.com
Source: C:\Windows\explorer.exe Network Connect: 198.185.159.144 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 217.160.0.254 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 50.87.238.189 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.melodezu.com
Source: C:\Windows\explorer.exe Domain query: www.tinsley.website
Source: C:\Windows\explorer.exe Network Connect: 64.227.87.162 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mydreamtv.net
Source: C:\Windows\explorer.exe Domain query: www.cajunseafoodstcloud.com
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Section loaded: unknown target: C:\Users\user\Desktop\wREFu91LXZ.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: 80000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\wREFu91LXZ.exe Process created: C:\Users\user\Desktop\wREFu91LXZ.exe 'C:\Users\user\Desktop\wREFu91LXZ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\wREFu91LXZ.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.232284109.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.261365308.0000000001980000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.247668679.000000000871F000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.261365308.0000000001980000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.261365308.0000000001980000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.wREFu91LXZ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.wREFu91LXZ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.wREFu91LXZ.exe.21a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.230049818.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.273287950.0000000006399000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.486466512.0000000000430000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487707401.0000000004060000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.487516890.0000000002A10000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.283872070.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284026050.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.227451103.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.284250937.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 452405 Sample: wREFu91LXZ.exe Startdate: 22/07/2021 Architecture: WINDOWS Score: 100 34 www.wthcoffee.com 2->34 36 www.avito-payment.life 2->36 38 wthcoffee.com 2->38 42 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->42 44 Found malware configuration 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 4 other signatures 2->48 11 wREFu91LXZ.exe 2->11         started        signatures3 process4 signatures5 56 Detected unpacking (changes PE section rights) 11->56 58 Maps a DLL or memory area into another process 11->58 60 Tries to detect virtualization through RDTSC time measurements 11->60 14 wREFu91LXZ.exe 11->14         started        process6 signatures7 62 Modifies the context of a thread in another process (thread injection) 14->62 64 Maps a DLL or memory area into another process 14->64 66 Sample uses process hollowing technique 14->66 68 Queues an APC in another process (thread injection) 14->68 17 explorer.exe 14->17 injected process8 dnsIp9 28 tinsley.website 50.87.238.189, 49741, 80 UNIFIEDLAYER-AS-1US United States 17->28 30 matcitekids.com 50.87.248.20, 49743, 80 UNIFIEDLAYER-AS-1US United States 17->30 32 14 other IPs or domains 17->32 40 System process connects to network (likely due to code injection or exploit) 17->40 21 msiexec.exe 17->21         started        signatures10 process11 signatures12 50 Modifies the context of a thread in another process (thread injection) 21->50 52 Maps a DLL or memory area into another process 21->52 54 Tries to detect virtualization through RDTSC time measurements 21->54 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.185.159.144
 ext-sq.squarespace.com United States
53831 SQUARESPACEUS false
217.160.0.254
 www.surivaganza.com Germany
8560 ONEANDONE-ASBrauerstrasse48DE true
50.87.238.189
 tinsley.website United States
46606 UNIFIEDLAYER-AS-1US true
52.5.43.61
 cajunseafoodstcloud.com United States
14618 AMAZON-AESUS true
64.227.87.162
 melodezu.com United States
14061 DIGITALOCEAN-ASNUS true
34.102.136.180
 extinctionbrews.com United States
15169 GOOGLEUS false
50.87.248.20
 matcitekids.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
matcitekids.com 50.87.248.20 true
extinctionbrews.com 34.102.136.180 true
www.surivaganza.com 217.160.0.254 true
tinsley.website 50.87.238.189 true
cajunseafoodstcloud.com 52.5.43.61 true
ext-sq.squarespace.com 198.185.159.144 true
melodezu.com 64.227.87.162 true
wthcoffee.com 184.168.131.241 true
www.wthcoffee.com unknown unknown
www.avito-payment.life unknown unknown
www.oikoschain.com unknown unknown
www.melodezu.com unknown unknown
www.tinsley.website unknown unknown
www.matcitekids.com unknown unknown
www.mydreamtv.net unknown unknown
www.chaneabond.com unknown unknown
www.extinctionbrews.com unknown unknown
www.monsoonnerd.com unknown unknown
www.cajunseafoodstcloud.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.cajunseafoodstcloud.com/dy8g/?9rrLUp1=sC7FhjJqcCFIEoUuEobIBnrRYwOZzG9nc/x6jFk5Keq5TgsKgOpKFfaz6JoBJPzzv7cu&sxlxj=RL30W true
  • Avira URL Cloud: safe
 unknown
http://www.tinsley.website/dy8g/?9rrLUp1=iVPDfBhYBy5JvywJlu7/jTaNaIK/WCHUrbFXeojMH/nMVdHPbpxjQuq5aGN6jhO1pTuT&sxlxj=RL30W true
  • Avira URL Cloud: safe
 unknown
http://www.matcitekids.com/dy8g/?9rrLUp1=dI9eO6GEnVuhhF2IZBGZI9CJMc/scmM0Fs5NmUifzPq1VUdHCmcaYQjC6cJJVTF2eMwa&sxlxj=RL30W true
  • Avira URL Cloud: safe
 unknown
www.extinctionbrews.com/dy8g/ true
  • Avira URL Cloud: safe
 low
http://www.extinctionbrews.com/dy8g/?9rrLUp1=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoFjnAjbDmWUu&sxlxj=RL30W false
  • Avira URL Cloud: safe
 unknown
http://www.chaneabond.com/dy8g/?9rrLUp1=0Hs+m/QFKKZkFwACjLHyI7vfWqidr4y2jXRg5Hngc5JW+skIzqaHxis+6ShLP6A0B+d4&sxlxj=RL30W true
  • Avira URL Cloud: safe
 unknown
http://www.melodezu.com/dy8g/?9rrLUp1=qBaU/+yfeYHlIZouGPofXU4iidVfFInHYvrLlGgOmZTTl18u/I/MgAYEWpA7pfREgQYT&sxlxj=RL30W true
  • Avira URL Cloud: safe
 unknown