Windows Analysis Report DOCS.exe

Overview

General Information

Sample Name: DOCS.exe
Analysis ID: 452541
MD5: 8e2aa51f45393d980a4d9b20947976b6
SHA1: 44742c0e7752ece4ed49c40d0f1b4e893c291005
SHA256: 02e6972eec66f1f2b9898fa662d59c1f47856f180dad385d766399ecaf763f5b
Tags: AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AgentTesla
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the hosts file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

AV Detection:

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe ReversingLabs: Detection: 52%
Multi AV Scanner detection for submitted file
Source: DOCS.exe Virustotal: Detection: 41% Perma Link
Source: DOCS.exe ReversingLabs: Detection: 52%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: DOCS.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 4.2.DOCS.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 18.2.NXLun.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: DOCS.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: DOCS.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: RunPE.pdb source: DOCS.exe, NXLun.exe, 00000011.00000002.337797812.0000000002901000.00000004.00000001.sdmp

Networking:

barindex
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.7:49738 -> 208.91.199.225:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.7:49738 -> 208.91.199.225:587
Source: unknown DNS traffic detected: queries for: us2.smtp.mailhostbox.com
Source: DOCS.exe, 00000004.00000002.502145216.0000000002B61000.00000004.00000001.sdmp, NXLun.exe, 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: NXLun.exe, 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: DOCS.exe, 00000004.00000002.506216357.0000000002ED0000.00000004.00000001.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: NXLun.exe, 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp String found in binary or memory: http://hFHvHh.com
Source: DOCS.exe, 00000004.00000002.506216357.0000000002ED0000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.sectigo.com0A
Source: DOCS.exe, 00000004.00000002.506101125.0000000002EC6000.00000004.00000001.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: DOCS.exe, 00000004.00000002.502145216.0000000002B61000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: NXLun.exe, 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: DOCS.exe, 00000004.00000002.506216357.0000000002ED0000.00000004.00000001.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: DOCS.exe, 00000004.00000002.506391286.0000000002EED000.00000004.00000001.sdmp, DOCS.exe, 00000004.00000002.506031808.0000000002EC0000.00000004.00000001.sdmp, DOCS.exe, 00000004.00000002.502145216.0000000002B61000.00000004.00000001.sdmp, DOCS.exe, 00000004.00000002.505417799.0000000002E89000.00000004.00000001.sdmp, DOCS.exe, 00000004.00000002.506468128.0000000002EF5000.00000004.00000001.sdmp String found in binary or memory: https://wiYfivfC8nSIDolSjnz.org
Source: DOCS.exe, 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp, DOCS.exe, 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp, NXLun.exe, 00000011.00000002.347326587.0000000003CD5000.00000004.00000001.sdmp, NXLun.exe, 00000012.00000002.495132037.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: DOCS.exe, 00000004.00000002.502145216.0000000002B61000.00000004.00000001.sdmp, NXLun.exe, 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: NXLun.exe, 00000011.00000002.336441928.0000000000BF8000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\DOCS.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

System Summary:

barindex
Detected potential crypto function
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052D3F50 1_2_052D3F50
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052C86F9 1_2_052C86F9
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C85440 1_2_02C85440
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C85A88 1_2_02C85A88
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C83F68 1_2_02C83F68
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C85431 1_2_02C85431
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C83F58 1_2_02C83F58
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F53023 4_2_00F53023
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F507D0 4_2_00F507D0
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F56B68 4_2_00F56B68
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F51F88 4_2_00F51F88
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F572C0 4_2_00F572C0
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F59C50 4_2_00F59C50
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F5CFD8 4_2_00F5CFD8
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F8A208 4_2_00F8A208
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F856A0 4_2_00F856A0
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00FD47A0 4_2_00FD47A0
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00FD4790 4_2_00FD4790
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00FD4772 4_2_00FD4772
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D2D688 17_2_04D2D688
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D26850 17_2_04D26850
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D26FF8 17_2_04D26FF8
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D26FE8 17_2_04D26FE8
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 18_2_02E647A0 18_2_02E647A0
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 18_2_02E63E58 18_2_02E63E58
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 18_2_02E64772 18_2_02E64772
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 18_2_02E64730 18_2_02E64730
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 20_2_030C5431 20_2_030C5431
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 20_2_030C5A88 20_2_030C5A88
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 20_2_030C3F58 20_2_030C3F58
Sample file is different than original file name gathered from version info
Source: DOCS.exe Binary or memory string: OriginalFilename vs DOCS.exe
Source: DOCS.exe, 00000001.00000002.241023078.0000000000962000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSymlink-Maker.exe< vs DOCS.exe
Source: DOCS.exe, 00000001.00000002.247879758.00000000052C0000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameRunPE.dll" vs DOCS.exe
Source: DOCS.exe, 00000001.00000002.243031996.0000000003E8C000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameWallpaperChanger.dllB vs DOCS.exe
Source: DOCS.exe, 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameufAxLJHDduVRtbIELqoQRnLFzE.exe4 vs DOCS.exe
Source: DOCS.exe, 00000004.00000002.496448083.00000000007B2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSymlink-Maker.exe< vs DOCS.exe
Source: DOCS.exe, 00000004.00000002.510065671.0000000005FB0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemscorrc.dllT vs DOCS.exe
Source: DOCS.exe, 00000004.00000002.496583189.0000000000B58000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUNKNOWN_FILET vs DOCS.exe
Source: DOCS.exe, 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameufAxLJHDduVRtbIELqoQRnLFzE.exe4 vs DOCS.exe
Source: DOCS.exe Binary or memory string: OriginalFilenameSymlink-Maker.exe< vs DOCS.exe
Uses 32bit PE files
Source: DOCS.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: DOCS.exe, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: DOCS.exe, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.0.DOCS.exe.890000.0.unpack, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.0.DOCS.exe.890000.0.unpack, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.DOCS.exe.890000.0.unpack, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1.2.DOCS.exe.890000.0.unpack, Regedit.cs Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: NXLun.exe.4.dr, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: NXLun.exe.4.dr, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.0.DOCS.exe.6e0000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 4.0.DOCS.exe.6e0000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 17.0.NXLun.exe.3a0000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 17.0.NXLun.exe.3a0000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 17.2.NXLun.exe.3a0000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 17.2.NXLun.exe.3a0000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.DOCS.exe.890000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.DOCS.exe.890000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.0.DOCS.exe.890000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.DOCS.exe.890000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.2.DOCS.exe.6e0000.1.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 4.2.DOCS.exe.6e0000.1.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DOCS.exe, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: DOCS.exe, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 18.0.NXLun.exe.a30000.0.unpack, Regedit.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 18.0.NXLun.exe.a30000.0.unpack, Regedit.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: classification engine Classification label: mal100.troj.adwa.spyw.evad.winEXE@7/6@1/1
Source: C:\Users\user\Desktop\DOCS.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DOCS.exe.log Jump to behavior
Source: DOCS.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\DOCS.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCS.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: DOCS.exe Virustotal: Detection: 41%
Source: DOCS.exe ReversingLabs: Detection: 52%
Source: C:\Users\user\Desktop\DOCS.exe File read: C:\Users\user\Desktop\DOCS.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\DOCS.exe 'C:\Users\user\Desktop\DOCS.exe'
Source: C:\Users\user\Desktop\DOCS.exe Process created: C:\Users\user\Desktop\DOCS.exe C:\Users\user\Desktop\DOCS.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe C:\Users\user\AppData\Roaming\NXLun\NXLun.exe
Source: unknown Process created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe 'C:\Users\user\AppData\Roaming\NXLun\NXLun.exe'
Source: C:\Users\user\Desktop\DOCS.exe Process created: C:\Users\user\Desktop\DOCS.exe C:\Users\user\Desktop\DOCS.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: DOCS.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: DOCS.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: RunPE.pdb source: DOCS.exe, NXLun.exe, 00000011.00000002.337797812.0000000002901000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Binary contains a suspicious time stamp
Source: DOCS.exe Static PE information: 0x91B5E3D7 [Thu Jun 20 04:11:03 2047 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052C513D pushfd ; retf 1_2_052C5143
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052C4D87 push ebx; iretd 1_2_052C4D88
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052C936D push es; iretd 1_2_052C936E
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_052C76F5 push ss; retf 1_2_052C7892
Source: C:\Users\user\Desktop\DOCS.exe Code function: 1_2_02C8C032 push edx; retf 1_2_02C8C02A
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D29092 push E0E8CE8Bh; ret 17_2_04D2909D
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D2E9C2 pushad ; ret 17_2_04D2E9C9
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D265E3 push 2400025Eh; retf 17_2_04D265F1
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Code function: 17_2_04D2EE73 push ebp; retf 17_2_04D2EE78

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\DOCS.exe File created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Jump to dropped file
Source: C:\Users\user\Desktop\DOCS.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLun Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NXLun Jump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe:Zone.Identifier read attributes | delete Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\DOCS.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\DOCS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\DOCS.exe Window / User API: threadDelayed 1070 Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Window / User API: threadDelayed 8785 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Window / User API: threadDelayed 9549 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\DOCS.exe TID: 1232 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe TID: 5072 Thread sleep time: -20291418481080494s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe TID: 5712 Thread sleep count: 1070 > 30 Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe TID: 5712 Thread sleep count: 8785 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 4644 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 4840 Thread sleep time: -19369081277395017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 4520 Thread sleep count: 296 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe TID: 4520 Thread sleep count: 9549 > 30 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCS.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\DOCS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: NXLun.exe Binary or memory string: 3oEK0R7Nl5u1+kFZIzuylTq5IlSverUm3tJvbDoGCqNlts9V00GfVjTuJYdbQ18DniAOJNJ3hmmLJ7Lnt4nVuOFzn56MTpkwqqGN8dutXcbdfZ9RnrQemUuZykL0LGjQpW
Source: DOCS.exe, 00000004.00000002.510536562.00000000064B0000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\DOCS.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\DOCS.exe Code function: 4_2_00F5A3B0 LdrInitializeThunk, 4_2_00F5A3B0
Enables debug privileges
Source: C:\Users\user\Desktop\DOCS.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\DOCS.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\DOCS.exe Process created: C:\Users\user\Desktop\DOCS.exe C:\Users\user\Desktop\DOCS.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Process created: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Jump to behavior
Source: DOCS.exe, 00000004.00000002.501242387.0000000001570000.00000002.00000001.sdmp, NXLun.exe, 00000012.00000002.500083454.00000000018E0000.00000002.00000001.sdmp Binary or memory string: uProgram Manager
Source: DOCS.exe, 00000004.00000002.501242387.0000000001570000.00000002.00000001.sdmp, NXLun.exe, 00000012.00000002.500083454.00000000018E0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: DOCS.exe, 00000004.00000002.501242387.0000000001570000.00000002.00000001.sdmp, NXLun.exe, 00000012.00000002.500083454.00000000018E0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: DOCS.exe, 00000004.00000002.501242387.0000000001570000.00000002.00000001.sdmp, NXLun.exe, 00000012.00000002.500083454.00000000018E0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Users\user\Desktop\DOCS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Users\user\Desktop\DOCS.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\NXLun\NXLun.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Modifies the hosts file
Source: C:\Users\user\Desktop\DOCS.exe File written: C:\Windows\System32\drivers\etc\hosts Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.DOCS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.NXLun.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4025b40.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c75b40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.347326587.0000000003CD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.495132037.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.347157176.0000000003C1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244277836.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Yara detected AgentTesla
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.DOCS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.2dc55d4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.NXLun.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4025b40.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c75b40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.2dd4408.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.2a15758.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.2a2458c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.347326587.0000000003CD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.495132037.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.347157176.0000000003C1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.241626967.0000000002CB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244277836.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.337797812.0000000002901000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCS.exe PID: 5928, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCS.exe PID: 4992, type: MEMORY
Source: Yara match File source: Process Memory Space: NXLun.exe PID: 5388, type: MEMORY
Source: Yara match File source: Process Memory Space: NXLun.exe PID: 5372, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\DOCS.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\DOCS.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000004.00000002.502145216.0000000002B61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCS.exe PID: 5928, type: MEMORY
Source: Yara match File source: Process Memory Space: NXLun.exe PID: 5388, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.DOCS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.NXLun.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4025b40.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c75b40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.347326587.0000000003CD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.495132037.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.347157176.0000000003C1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244277836.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Yara detected AgentTesla
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4045b60.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.DOCS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.2dc55d4.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3cd5b80.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.NXLun.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4085b80.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.4025b40.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c75b40.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.3c95b60.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.DOCS.exe.2dd4408.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.2a15758.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.NXLun.exe.2a2458c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000002.347326587.0000000003CD5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.495132037.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.347157176.0000000003C1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244914282.0000000004085000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.241626967.0000000002CB1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.244277836.0000000003FCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.500663594.0000000003081000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.337797812.0000000002901000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.495044836.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCS.exe PID: 5928, type: MEMORY
Source: Yara match File source: Process Memory Space: DOCS.exe PID: 4992, type: MEMORY
Source: Yara match File source: Process Memory Space: NXLun.exe PID: 5388, type: MEMORY
Source: Yara match File source: Process Memory Space: NXLun.exe PID: 5372, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 452541 Sample: DOCS.exe Startdate: 22/07/2021 Architecture: WINDOWS Score: 100 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected AgentTesla 2->41 43 Yara detected AgentTesla 2->43 45 Machine Learning detection for sample 2->45 6 DOCS.exe 3 2->6         started        10 NXLun.exe 3 2->10         started        12 NXLun.exe 2->12         started        process3 file4 21 C:\Users\user\AppData\Local\...\DOCS.exe.log, ASCII 6->21 dropped 47 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 6->47 49 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 6->49 14 DOCS.exe 2 5 6->14         started        51 Multi AV Scanner detection for dropped file 10->51 53 Machine Learning detection for dropped file 10->53 19 NXLun.exe 2 10->19         started        signatures5 process6 dnsIp7 29 us2.smtp.mailhostbox.com 208.91.199.225, 49738, 587 PUBLIC-DOMAIN-REGISTRYUS United States 14->29 23 C:\Users\user\AppData\Roaming\...23XLun.exe, PE32 14->23 dropped 25 C:\Users\user\...25XLun.exe:Zone.Identifier, ASCII 14->25 dropped 31 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 14->31 33 Tries to steal Mail credentials (via file access) 14->33 35 Tries to harvest and steal ftp login credentials 14->35 37 3 other signatures 14->37 27 C:\Windows\System32\drivers\etc\hosts, ASCII 19->27 dropped file8 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
208.91.199.225
 us2.smtp.mailhostbox.com United States
394695 PUBLIC-DOMAIN-REGISTRYUS false

Contacted Domains

Name IP Active
us2.smtp.mailhostbox.com 208.91.199.225 true