Windows Analysis Report QxVf0A9SFT

Overview

General Information

Sample Name:	QxVf0A9SFT (renamed file extension from none to exe)
Analysis ID:	452671
MD5:	04ea3fcf816b22f98adf5267204615f0
SHA1:	06a21e2a043f00a4f1f364975b3de139f8f508f3
SHA256:	62269dc86f9f29aeeeb4966505408fccefef782f08334def058cdca5884b9c4b
Tags:	32exetrojan
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Sigma detected: CMSTP Execution Process Creation

Tries to detect virtualization through RDTSC time measurements

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a Windows Living Off The Land Binaries (LOL bins)

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Signatures

AV Detection:

Antivirus detection for URL or domain

Source: http://www.alfenas.info/p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}

Multi AV Scanner detection for submitted file

Source: QxVf0A9SFT.exe

Virustotal: Detection: 44%

Perma Link

Yara detected FormBook

Source: Yara match	File source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY

Machine Learning detection for sample

Source: QxVf0A9SFT.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: QxVf0A9SFT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: QxVf0A9SFT.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: cmstp.pdbGCTL source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe, 00000015.00000002.502745241.00000000044F0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe
Source:	Binary string: cmstp.pdb source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 4x nop then pop edi	18_2_00416282
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 4x nop then pop ebx	18_2_00406A94
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop ebx	21_2_02B66A95
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi	21_2_02B76282

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.adultpeace.com/p2io/

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe

DNS query: www.m678.xyz

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it6teibs/QUjW HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv HTTP/1.1Host: www.alfenas.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 163.44.239.73 163.44.239.73

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP

Source: global traffic	HTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it6teibs/QUjW HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv HTTP/1.1Host: www.alfenas.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.adultpeace.com

Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: QxVf0A9SFT.exe	String found in binary or memory: http://tempuri.org/SeguridadDS.xsd
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: QxVf0A9SFT.exe, 00000000.00000003.237514448.0000000006250000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comuL
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: QxVf0A9SFT.exe, 00000000.00000003.242529960.000000000624D000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: QxVf0A9SFT.exe, 00000000.00000003.234445179.000000000625B000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: QxVf0A9SFT.exe, 00000000.00000003.234412924.000000000625E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.comX
Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn&
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnb
Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnd
Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnu-h
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-czPgm
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/7g
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/VerdMgH
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/tgA
Source: QxVf0A9SFT.exe, 00000000.00000003.233768270.000000000625E000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: QxVf0A9SFT.exe, 00000000.00000003.233768270.000000000625E000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.comd
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: QxVf0A9SFT.exe, 00000000.00000003.235729383.0000000006249000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: QxVf0A9SFT.exe, 00000000.00000003.234871936.000000000625B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com4
Source: QxVf0A9SFT.exe, 00000000.00000003.234787437.000000000625B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comc
Source: QxVf0A9SFT.exe, 00000000.00000003.234871936.000000000625B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comc=
Source: QxVf0A9SFT.exe, 00000000.00000003.234922559.000000000625B000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.comcom4
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_004181B0 NtCreateFile,	18_2_004181B0
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00418260 NtReadFile,	18_2_00418260
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_004182E0 NtClose,	18_2_004182E0
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00418390 NtAllocateVirtualMemory,	18_2_00418390
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_004182AC NtReadFile,	18_2_004182AC
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041838B NtAllocateVirtualMemory,	18_2_0041838B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559840 NtDelayExecution,LdrInitializeThunk,	21_2_04559840
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559860 NtQuerySystemInformation,LdrInitializeThunk,	21_2_04559860
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559540 NtReadFile,LdrInitializeThunk,	21_2_04559540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559910 NtAdjustPrivilegesToken,LdrInitializeThunk,	21_2_04559910
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045595D0 NtClose,LdrInitializeThunk,	21_2_045595D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045599A0 NtCreateSection,LdrInitializeThunk,	21_2_045599A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559650 NtQueryValueKey,LdrInitializeThunk,	21_2_04559650
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559A50 NtCreateFile,LdrInitializeThunk,	21_2_04559A50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559660 NtAllocateVirtualMemory,LdrInitializeThunk,	21_2_04559660
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045596D0 NtCreateKey,LdrInitializeThunk,	21_2_045596D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045596E0 NtFreeVirtualMemory,LdrInitializeThunk,	21_2_045596E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559710 NtQueryInformationToken,LdrInitializeThunk,	21_2_04559710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559FE0 NtCreateMutant,LdrInitializeThunk,	21_2_04559FE0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559780 NtMapViewOfSection,LdrInitializeThunk,	21_2_04559780
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0455B040 NtSuspendThread,	21_2_0455B040
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559820 NtEnumerateKey,	21_2_04559820
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045598F0 NtReadVirtualMemory,	21_2_045598F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045598A0 NtWriteVirtualMemory,	21_2_045598A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559950 NtQueueApcThread,	21_2_04559950
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559560 NtWriteFile,	21_2_04559560
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0455AD30 NtSetContextThread,	21_2_0455AD30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559520 NtWaitForSingleObject,	21_2_04559520
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045599D0 NtCreateProcessEx,	21_2_045599D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045595F0 NtQueryInformationFile,	21_2_045595F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559670 NtQueryInformationProcess,	21_2_04559670
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559610 NtEnumerateValueKey,	21_2_04559610
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559A10 NtQuerySection,	21_2_04559A10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559A00 NtProtectVirtualMemory,	21_2_04559A00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559A20 NtResumeThread,	21_2_04559A20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559A80 NtOpenDirectoryObject,	21_2_04559A80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559770 NtSetInformationFile,	21_2_04559770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0455A770 NtOpenThread,	21_2_0455A770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559760 NtOpenProcess,	21_2_04559760
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0455A710 NtOpenProcessToken,	21_2_0455A710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559B00 NtSetValueKey,	21_2_04559B00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04559730 NtQueryVirtualMemory,	21_2_04559730
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0455A3B0 NtGetContextThread,	21_2_0455A3B0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045597A0 NtUnmapViewOfSection,	21_2_045597A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B782E0 NtClose,	21_2_02B782E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B78260 NtReadFile,	21_2_02B78260
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B78390 NtAllocateVirtualMemory,	21_2_02B78390
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B781B0 NtCreateFile,	21_2_02B781B0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B782AC NtReadFile,	21_2_02B782AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7838B NtAllocateVirtualMemory,	21_2_02B7838B

Detected potential crypto function

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00401030	18_2_00401030
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B8B1	18_2_0041B8B1
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B963	18_2_0041B963
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00408C4B	18_2_00408C4B
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00408C50	18_2_00408C50
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B493	18_2_0041B493
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B496	18_2_0041B496
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041C539	18_2_0041C539
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00402D89	18_2_00402D89
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00402D90	18_2_00402D90
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041CE85	18_2_0041CE85
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041BF12	18_2_0041BF12
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041C795	18_2_0041C795
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00402FB0	18_2_00402FB0
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00E4A553	18_2_00E4A553
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00E447A5	18_2_00E447A5
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00E4ACFD	18_2_00E4ACFD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0452841F	21_2_0452841F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045D1002	21_2_045D1002
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0452B090	21_2_0452B090
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045420A0	21_2_045420A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E20A8	21_2_045E20A8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E1D55	21_2_045E1D55
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0451F900	21_2_0451F900
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E2D07	21_2_045E2D07
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04510D20	21_2_04510D20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04534120	21_2_04534120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0452D5E0	21_2_0452D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04542581	21_2_04542581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_04536E30	21_2_04536E30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E2EF7	21_2_045E2EF7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E22AE	21_2_045E22AE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E2B28	21_2_045E2B28
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_045E1FF1	21_2_045E1FF1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0454EBB0	21_2_0454EBB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B8B1	21_2_02B7B8B1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B954	21_2_02B7B954
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7CE85	21_2_02B7CE85
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B62FB0	21_2_02B62FB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7C795	21_2_02B7C795
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7BF12	21_2_02B7BF12
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B496	21_2_02B7B496
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B493	21_2_02B7B493
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B68C50	21_2_02B68C50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B68C4B	21_2_02B68C4B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B62D90	21_2_02B62D90
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B62D89	21_2_02B62D89
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7C539	21_2_02B7C539

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\cmstp.exe

Code function: String function: 0451B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe
Source: QxVf0A9SFT.exe	Binary or memory string: OriginalFilename vs QxVf0A9SFT.exe
Source: QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe
Source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QxVf0A9SFT.exe
Source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCMSTP.EXE` vs QxVf0A9SFT.exe
Source: QxVf0A9SFT.exe	Binary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe

Uses 32bit PE files

Source: QxVf0A9SFT.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses a Windows Living Off The Land Binaries (LOL bins)

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe

Yara signature match

Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@6/2

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QxVf0A9SFT.exe.log

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [USUARIO] ([cve_empleado], [nombre], [ape_pat], [ape_mat], [correo], [id_usuario], [fecha_ingreso], [estado], [Bloqueo], [FechaCaducidad], [id_sucursal], [Autorizar], [jefe], [id_depto]) VALUES (@cve_empleado, @nombre, @ape_pat, @ape_mat, @correo, @id_usuario, @fecha_ingreso, @estado, @Bloqueo, @FechaCaducidad, @id_sucursal, @Autorizar, @jefe, @id_depto);
Source: QxVf0A9SFT.exe	Binary or memory string: UPDATE USUARIO SET password = @Password WHERE (cve_empleado = @Original_cve_empleado); SELECT cve_emp
Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [PERFILES] ([CveEmpresa], [cve_perfil], [id_sistema]) VALUES (@CveEmpresa, @cve_perfil, @id_sistema);
Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [SEG_MAESTRA] ([cve_perfil], [nom_sistema], [modulo], [cve_menu], [cve_submenu], [cve_ssubmenu], [cve_sssubmenu], [menu]) VALUES (@cve_perfil, @nom_sistema, @modulo, @cve_menu, @cve_submenu, @cve_ssubmenu, @cve_sssubmenu, @menu);
Source: QxVf0A9SFT.exe	Binary or memory string: INSERT INTO [SISTEMA] ([id_sistema], [nom_sistema]) VALUES (@id_sistema, @nom_sistema); SELECT id_sistema, nom_sistema FROM SISTEM
Source: QxVf0A9SFT.exe	Binary or memory string: INSERT INTO [PERFILES] ([CveEmpresa], [cve_perfil], [id_sistema]) VALUES (@CveEmpresa, @cve_perfil, @id_sistema); SELECT CveEmpres
Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: UPDATE [PERFILES] SET [CveEmpresa] = @CveEmpresa, [cve_perfil] = @cve_perfil, [id_sistema] = @id_sistema WHERE (([CveEmpresa] = @Original_CveEmpresa) AND ([cve_perfil] = @Original_cve_perfil) AND ([id_sistema] = @Original_id_sistema));
Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmp	Binary or memory string: UPDATE [DEPTO] SET [id_depto] = @id_depto, [nom_depto] = @nom_depto WHERE (([id_depto] = @Original_id_depto) AND ((@IsNull_nom_depto = 1 AND [nom_depto] IS NULL) OR ([nom_depto] = @Original_nom_depto)));
Source: QxVf0A9SFT.exe	Binary or memory string: INSERT INTO [DEPTO] ([id_depto], [nom_depto]) VALUES (@id_depto, @nom_depto); SELECT id_depto, nom_depto FROM DEPTO WHERE (id_dept
Source: QxVf0A9SFT.exe	Binary or memory string: INSERT INTO [SUCURSAL] ([id_sucursal], [nom_sucursal]) VALUES (@id_sucursal, @nom_sucursal); SELECT id_sucursal, nom_sucursal FROM

Source: unknown	Process created: C:\Users\user\Desktop\QxVf0A9SFT.exe 'C:\Users\user\Desktop\QxVf0A9SFT.exe'
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process created: C:\Users\user\Desktop\QxVf0A9SFT.exe C:\Users\user\Desktop\QxVf0A9SFT.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process created: C:\Users\user\Desktop\QxVf0A9SFT.exe C:\Users\user\Desktop\QxVf0A9SFT.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe'	Jump to behavior

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B2A2 push cs; ret	18_2_0041B2A3
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B3F2 push eax; ret	18_2_0041B3F8
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B3FB push eax; ret	18_2_0041B462
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B3A5 push eax; ret	18_2_0041B3F8
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041B45C push eax; ret	18_2_0041B462
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00415414 push esp; ret	18_2_00415416
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00414F46 push cs; ret	18_2_00414F47
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_0041BF12 push dword ptr [8427D5C5h]; ret	18_2_0041C1FF
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00415FC5 push ebp; ret	18_2_00415FC6
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00E4C06A push 00000000h; iretd	18_2_00E4C0B4
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Code function: 18_2_00E447A5 push es; iretd	18_2_00E44A13
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_0456D0D1 push ecx; ret	21_2_0456D0E4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B2A2 push cs; ret	21_2_02B7B2A3
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B3A5 push eax; ret	21_2_02B7B3F8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B3F2 push eax; ret	21_2_02B7B3F8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B3FB push eax; ret	21_2_02B7B462
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B75FC5 push ebp; ret	21_2_02B75FC6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7BF12 push dword ptr [8427D5C5h]; ret	21_2_02B7C1FF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B74F46 push cs; ret	21_2_02B74F47
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B75414 push esp; ret	21_2_02B75416
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 21_2_02B7B45C push eax; ret	21_2_02B7B462

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000002B685E4 second address: 0000000002B685EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000002B6896E second address: 0000000002B68974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe TID: 2200	Thread sleep time: -48661s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe TID: 5508	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Thread delayed: delay time: 48661			Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000014.00000000.329623748.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000014.00000000.315086166.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000014.00000000.328359455.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: QxVf0A9SFT.exe	Binary or memory string: zE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD\|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg\|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e\|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ]tM5W\|Y5fY<YeDL[]nopgyMKX3QZ]tM5WzE[Ti4JD\|YJ]s]6e\|EIgmYpdl<nfoU[gz45eG<YeDPZeV]WerYHWsYZfGgmTWg4U3EzTqEqVWooe
Source: explorer.exe, 00000014.00000000.330513195.0000000008A9D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}user
Source: explorer.exe, 00000014.00000000.343866477.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000014.00000000.329728449.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000014.00000000.354895549.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000014.00000000.328359455.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000014.00000000.328359455.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000014.00000000.329728449.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: explorer.exe, 00000014.00000000.330513195.0000000008A9D000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}AppData
Source: explorer.exe, 00000014.00000000.328359455.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\explorer.exe	Domain query: www.m678.xyz
Source: C:\Windows\explorer.exe	Domain query: www.buylocalclub.info
Source: C:\Windows\explorer.exe	Network Connect: 163.44.239.73 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.alfenas.info
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.adultpeace.com

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\QxVf0A9SFT.exe	Thread register set: target process: 3472			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Thread register set: target process: 3472			Jump to behavior

Source: explorer.exe, 00000014.00000000.329784447.00000000089FF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000014.00000000.311911048.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000014.00000000.311911048.0000000001640000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000014.00000000.343752151.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000014.00000000.311911048.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000014.00000000.311911048.0000000001640000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.102.136.180	alfenas.info	United States		15169	GOOGLEUS	false
163.44.239.73	adultpeace.com	Japan		7506	INTERQGMOInternetIncJP	true

Name	IP	Active
advancedaccessapplications.com	34.98.99.30	true
adultpeace.com	163.44.239.73	true
alfenas.info	34.102.136.180	true
pixie.porkbun.com	44.227.76.166	true
www.hiddenwholesale.com	unknown	unknown
www.m678.xyz	unknown	unknown
www.buylocalclub.info	unknown	unknown
www.adultpeace.com	unknown	unknown
www.alfenas.info	unknown	unknown
www.advancedaccessapplications.com	unknown	unknown

Name	Malicious	Antivirus Detection	Reputation
www.adultpeace.com/p2io/	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://www.alfenas.info/p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv	false	Avira URL Cloud: malware	unknown
http://www.adultpeace.com/p2io/?YdE=9rL05XJhqvsTNT&xJB=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it6teibs/QUjW	true	Avira URL Cloud: safe	unknown

ID:	452671
Product:	CloudBasic
Start time:	17:45:07
Start date:	22.07.2021
Sample:	QxVf0A9SFT
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	04ea3fcf816b22f98adf5267204615f0
SHA1:	06a21e2a043f00a4f1f364975b3de139f8f508f3
SHA256:	62269dc86f9f29aeeeb4966505408fccefef782f08334def058cdca5884b9c4b
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Windows Analysis Report QxVf0A9SFT

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs