Loading ...

Play interactive tourEdit tour

Windows Analysis Report QxVf0A9SFT

Overview

General Information

Sample Name:QxVf0A9SFT (renamed file extension from none to exe)
Analysis ID:452671
MD5:04ea3fcf816b22f98adf5267204615f0
SHA1:06a21e2a043f00a4f1f364975b3de139f8f508f3
SHA256:62269dc86f9f29aeeeb4966505408fccefef782f08334def058cdca5884b9c4b
Tags:32exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • QxVf0A9SFT.exe (PID: 4464 cmdline: 'C:\Users\user\Desktop\QxVf0A9SFT.exe' MD5: 04EA3FCF816B22F98ADF5267204615F0)
    • QxVf0A9SFT.exe (PID: 3720 cmdline: C:\Users\user\Desktop\QxVf0A9SFT.exe MD5: 04EA3FCF816B22F98ADF5267204615F0)
      • explorer.exe (PID: 3472 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
        • cmstp.exe (PID: 612 cmdline: C:\Windows\SysWOW64\cmstp.exe MD5: 4833E65ED211C7F118D4A11E6FB58A09)
          • cmd.exe (PID: 5232 cmdline: /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)
            • conhost.exe (PID: 5220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x166a9:$sqlite3step: 68 34 1C 7B E1
    • 0x167bc:$sqlite3step: 68 34 1C 7B E1
    • 0x166d8:$sqlite3text: 68 38 2A 90 C5
    • 0x167fd:$sqlite3text: 68 38 2A 90 C5
    • 0x166eb:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16813:$sqlite3blob: 68 53 D8 7F 8C
    00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 10 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      18.2.QxVf0A9SFT.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        18.2.QxVf0A9SFT.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x85e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x8972:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x14685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x14171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x14787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x148ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x938a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x133ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa102:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x19777:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1a81a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        18.2.QxVf0A9SFT.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x166a9:$sqlite3step: 68 34 1C 7B E1
        • 0x167bc:$sqlite3step: 68 34 1C 7B E1
        • 0x166d8:$sqlite3text: 68 38 2A 90 C5
        • 0x167fd:$sqlite3text: 68 38 2A 90 C5
        • 0x166eb:$sqlite3blob: 68 53 D8 7F 8C
        • 0x16813:$sqlite3blob: 68 53 D8 7F 8C
        18.2.QxVf0A9SFT.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          18.2.QxVf0A9SFT.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x77e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x7b72:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x13885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x13371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x13987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x13aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x858a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x125ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x9302:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x18977:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x19a1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 1 entries

          Sigma Overview

          System Summary:

          barindex
          Sigma detected: CMSTP Execution Process CreationShow sources
          Source: Process startedAuthor: Nik Seetharaman: Data: Command: /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe', CommandLine: /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\SysWOW64\cmstp.exe, ParentImage: C:\Windows\SysWOW64\cmstp.exe, ParentProcessId: 612, ProcessCommandLine: /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe', ProcessId: 5232

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Antivirus detection for URL or domainShow sources
          Source: http://www.alfenas.info/p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dvAvira URL Cloud: Label: malware
          Found malware configurationShow sources
          Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.adultpeace.com/p2io/"], "decoy": ["essentiallyourscandles.com", "cleanxcare.com", "bigplatesmallwallet.com", "iotcloud.technology", "dmgt4m2g8y2uh.net", "malcorinmobiliaria.com", "thriveglucose.com", "fuhaitongxin.com", "magetu.info", "pyithuhluttaw.net", "myfavbutik.com", "xzklrhy.com", "anewdistraction.com", "mercuryaid.net", "thesoulrevitalist.com", "swayam-moj.com", "liminaltechnology.com", "lucytime.com", "alfenas.info", "carmelodesign.com", "newmopeds.com", "cyrilgraze.com", "ruhexuangou.com", "trendbold.com", "centergolosinas.com", "leonardocarrillo.com", "advancedaccessapplications.com", "aideliveryrobot.com", "defenestration.world", "zgcbw.net", "shopihy.com", "3cheer.com", "untylservice.com", "totally-seo.com", "cmannouncements.com", "tpcgzwlpyggm.mobi", "hfjxhs.com", "balloon-artists.com", "vectoroutlines.com", "boogerstv.com", "procircleacademy.com", "tricqr.com", "hazard-protection.com", "buylocalclub.info", "m678.xyz", "hiddenwholesale.com", "ololmychartlogin.com", "redudiban.com", "brunoecatarina.com", "69-1hn7uc.net", "zmzcrossrt.xyz", "dreamcashbuyers.com", "yunlimall.com", "jonathan-mandt.com", "painhut.com", "pandemisorgugirisi-tr.com", "sonderbach.net", "kce0728com.net", "austinpavingcompany.com", "biztekno.com", "rodriggi.com", "micheldrake.com", "foxwaybrasil.com", "a3i7ufz4pt3.net"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: QxVf0A9SFT.exeVirustotal: Detection: 44%Perma Link
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY
          Machine Learning detection for sampleShow sources
          Source: QxVf0A9SFT.exeJoe Sandbox ML: detected
          Source: 18.2.QxVf0A9SFT.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: QxVf0A9SFT.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: QxVf0A9SFT.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: cmstp.pdbGCTL source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
          Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe, 00000015.00000002.502745241.00000000044F0000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe
          Source: Binary string: cmstp.pdb source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
          Source: Binary string: wscui.pdb source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 4x nop then pop edi18_2_00416282
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 4x nop then pop ebx18_2_00406A94
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 4x nop then pop ebx21_2_02B66A95
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 4x nop then pop edi21_2_02B76282

          Networking:

          barindex
          Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
          Source: TrafficSnort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80
          Source: TrafficSnort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49726 -> 34.102.136.180:80
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.adultpeace.com/p2io/
          Performs DNS queries to domains with low reputationShow sources
          Source: C:\Windows\explorer.exeDNS query: www.m678.xyz
          Source: global trafficHTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it6teibs/QUjW HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv HTTP/1.1Host: www.alfenas.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: Joe Sandbox ViewIP Address: 163.44.239.73 163.44.239.73
          Source: Joe Sandbox ViewASN Name: INTERQGMOInternetIncJP INTERQGMOInternetIncJP
          Source: global trafficHTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=4oufm6g5t6Bqg3y0mDBWoA8I6Q2bNaX51tGc9mj7mZf0wZ/j7IpC3Y+it6teibs/QUjW HTTP/1.1Host: www.adultpeace.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: global trafficHTTP traffic detected: GET /p2io/?YdE=9rL05XJhqvsTNT&xJB=qSqSgno/BG4XQ9RzVLtR5zfvl4qKeuO7jrFeJ6D3vYZW0mQ/jO0gy2XM9tF7BGvyf3dv HTTP/1.1Host: www.alfenas.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
          Source: unknownDNS traffic detected: queries for: www.adultpeace.com
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: QxVf0A9SFT.exeString found in binary or memory: http://tempuri.org/SeguridadDS.xsd
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: QxVf0A9SFT.exe, 00000000.00000003.237514448.0000000006250000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.comuL
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: QxVf0A9SFT.exe, 00000000.00000003.242529960.000000000624D000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers:
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: QxVf0A9SFT.exe, 00000000.00000003.234445179.000000000625B000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: QxVf0A9SFT.exe, 00000000.00000003.234412924.000000000625E000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.comX
          Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn&
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnb
          Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnd
          Source: QxVf0A9SFT.exe, 00000000.00000003.236776997.000000000627D000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cnu-h
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/-czPgm
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/7g
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/VerdMgH
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
          Source: QxVf0A9SFT.exe, 00000000.00000003.238487110.0000000006244000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/jp/tgA
          Source: QxVf0A9SFT.exe, 00000000.00000003.233768270.000000000625E000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: QxVf0A9SFT.exe, 00000000.00000003.233768270.000000000625E000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.comd
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: QxVf0A9SFT.exe, 00000000.00000003.235729383.0000000006249000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: QxVf0A9SFT.exe, 00000000.00000003.234871936.000000000625B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com4
          Source: QxVf0A9SFT.exe, 00000000.00000003.234787437.000000000625B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comc
          Source: QxVf0A9SFT.exe, 00000000.00000003.234871936.000000000625B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comc=
          Source: QxVf0A9SFT.exe, 00000000.00000003.234922559.000000000625B000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.comcom4
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: explorer.exe, 00000014.00000000.332484999.000000000BC30000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORY

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_004181B0 NtCreateFile,18_2_004181B0
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00418260 NtReadFile,18_2_00418260
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_004182E0 NtClose,18_2_004182E0
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00418390 NtAllocateVirtualMemory,18_2_00418390
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_004182AC NtReadFile,18_2_004182AC
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041838B NtAllocateVirtualMemory,18_2_0041838B
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559840 NtDelayExecution,LdrInitializeThunk,21_2_04559840
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559860 NtQuerySystemInformation,LdrInitializeThunk,21_2_04559860
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559540 NtReadFile,LdrInitializeThunk,21_2_04559540
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559910 NtAdjustPrivilegesToken,LdrInitializeThunk,21_2_04559910
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045595D0 NtClose,LdrInitializeThunk,21_2_045595D0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045599A0 NtCreateSection,LdrInitializeThunk,21_2_045599A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559650 NtQueryValueKey,LdrInitializeThunk,21_2_04559650
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559A50 NtCreateFile,LdrInitializeThunk,21_2_04559A50
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559660 NtAllocateVirtualMemory,LdrInitializeThunk,21_2_04559660
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045596D0 NtCreateKey,LdrInitializeThunk,21_2_045596D0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045596E0 NtFreeVirtualMemory,LdrInitializeThunk,21_2_045596E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559710 NtQueryInformationToken,LdrInitializeThunk,21_2_04559710
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559FE0 NtCreateMutant,LdrInitializeThunk,21_2_04559FE0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559780 NtMapViewOfSection,LdrInitializeThunk,21_2_04559780
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0455B040 NtSuspendThread,21_2_0455B040
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559820 NtEnumerateKey,21_2_04559820
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045598F0 NtReadVirtualMemory,21_2_045598F0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045598A0 NtWriteVirtualMemory,21_2_045598A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559950 NtQueueApcThread,21_2_04559950
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559560 NtWriteFile,21_2_04559560
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0455AD30 NtSetContextThread,21_2_0455AD30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559520 NtWaitForSingleObject,21_2_04559520
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045599D0 NtCreateProcessEx,21_2_045599D0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045595F0 NtQueryInformationFile,21_2_045595F0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559670 NtQueryInformationProcess,21_2_04559670
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559610 NtEnumerateValueKey,21_2_04559610
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559A10 NtQuerySection,21_2_04559A10
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559A00 NtProtectVirtualMemory,21_2_04559A00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559A20 NtResumeThread,21_2_04559A20
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559A80 NtOpenDirectoryObject,21_2_04559A80
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559770 NtSetInformationFile,21_2_04559770
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0455A770 NtOpenThread,21_2_0455A770
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559760 NtOpenProcess,21_2_04559760
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0455A710 NtOpenProcessToken,21_2_0455A710
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559B00 NtSetValueKey,21_2_04559B00
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04559730 NtQueryVirtualMemory,21_2_04559730
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0455A3B0 NtGetContextThread,21_2_0455A3B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045597A0 NtUnmapViewOfSection,21_2_045597A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B782E0 NtClose,21_2_02B782E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B78260 NtReadFile,21_2_02B78260
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B78390 NtAllocateVirtualMemory,21_2_02B78390
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B781B0 NtCreateFile,21_2_02B781B0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B782AC NtReadFile,21_2_02B782AC
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7838B NtAllocateVirtualMemory,21_2_02B7838B
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0040103018_2_00401030
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B8B118_2_0041B8B1
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B96318_2_0041B963
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00408C4B18_2_00408C4B
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00408C5018_2_00408C50
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B49318_2_0041B493
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B49618_2_0041B496
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041C53918_2_0041C539
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00402D8918_2_00402D89
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00402D9018_2_00402D90
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041CE8518_2_0041CE85
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041BF1218_2_0041BF12
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041C79518_2_0041C795
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00402FB018_2_00402FB0
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00E4A55318_2_00E4A553
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00E447A518_2_00E447A5
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00E4ACFD18_2_00E4ACFD
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0452841F21_2_0452841F
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045D100221_2_045D1002
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0452B09021_2_0452B090
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045420A021_2_045420A0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E20A821_2_045E20A8
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E1D5521_2_045E1D55
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0451F90021_2_0451F900
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E2D0721_2_045E2D07
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04510D2021_2_04510D20
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0453412021_2_04534120
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0452D5E021_2_0452D5E0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0454258121_2_04542581
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_04536E3021_2_04536E30
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E2EF721_2_045E2EF7
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E22AE21_2_045E22AE
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E2B2821_2_045E2B28
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_045E1FF121_2_045E1FF1
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0454EBB021_2_0454EBB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B8B121_2_02B7B8B1
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B95421_2_02B7B954
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7CE8521_2_02B7CE85
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B62FB021_2_02B62FB0
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7C79521_2_02B7C795
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7BF1221_2_02B7BF12
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B49621_2_02B7B496
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B49321_2_02B7B493
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B68C5021_2_02B68C50
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B68C4B21_2_02B68C4B
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B62D9021_2_02B62D90
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B62D8921_2_02B62D89
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7C53921_2_02B7C539
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: String function: 0451B150 appears 35 times
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exeBinary or memory string: OriginalFilename vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameCMSTP.EXE` vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exeBinary or memory string: OriginalFilenameAppDomainSortingSetupIn.exe> vs QxVf0A9SFT.exe
          Source: QxVf0A9SFT.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
          Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 18.2.QxVf0A9SFT.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 18.2.QxVf0A9SFT.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000012.00000002.367232255.00000000018D0000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000012.00000002.366037368.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000015.00000002.501654097.0000000002B60000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000012.00000002.366993982.0000000001560000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000015.00000002.499466554.0000000000960000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: classification engineClassification label: mal100.troj.evad.winEXE@7/1@6/2
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\QxVf0A9SFT.exe.logJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5220:120:WilError_01
          Source: QxVf0A9SFT.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: C:\Windows\explorer.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: INSERT INTO [USUARIO] ([cve_empleado], [nombre], [ape_pat], [ape_mat], [correo], [id_usuario], [fecha_ingreso], [estado], [Bloqueo], [FechaCaducidad], [id_sucursal], [Autorizar], [jefe], [id_depto]) VALUES (@cve_empleado, @nombre, @ape_pat, @ape_mat, @correo, @id_usuario, @fecha_ingreso, @estado, @Bloqueo, @FechaCaducidad, @id_sucursal, @Autorizar, @jefe, @id_depto);
          Source: QxVf0A9SFT.exeBinary or memory string: UPDATE USUARIO SET password = @Password WHERE (cve_empleado = @Original_cve_empleado); SELECT cve_emp
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: INSERT INTO [PERFILES] ([CveEmpresa], [cve_perfil], [id_sistema]) VALUES (@CveEmpresa, @cve_perfil, @id_sistema);
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: INSERT INTO [SEG_MAESTRA] ([cve_perfil], [nom_sistema], [modulo], [cve_menu], [cve_submenu], [cve_ssubmenu], [cve_sssubmenu], [menu]) VALUES (@cve_perfil, @nom_sistema, @modulo, @cve_menu, @cve_submenu, @cve_ssubmenu, @cve_sssubmenu, @menu);
          Source: QxVf0A9SFT.exeBinary or memory string: INSERT INTO [SISTEMA] ([id_sistema], [nom_sistema]) VALUES (@id_sistema, @nom_sistema); SELECT id_sistema, nom_sistema FROM SISTEM
          Source: QxVf0A9SFT.exeBinary or memory string: INSERT INTO [PERFILES] ([CveEmpresa], [cve_perfil], [id_sistema]) VALUES (@CveEmpresa, @cve_perfil, @id_sistema); SELECT CveEmpres
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: UPDATE [PERFILES] SET [CveEmpresa] = @CveEmpresa, [cve_perfil] = @cve_perfil, [id_sistema] = @id_sistema WHERE (([CveEmpresa] = @Original_CveEmpresa) AND ([cve_perfil] = @Original_cve_perfil) AND ([id_sistema] = @Original_id_sistema));
          Source: QxVf0A9SFT.exe, 00000000.00000000.227936026.0000000000AA2000.00000002.00020000.sdmp, QxVf0A9SFT.exe, 00000012.00000002.366146647.0000000000E42000.00000002.00020000.sdmpBinary or memory string: UPDATE [DEPTO] SET [id_depto] = @id_depto, [nom_depto] = @nom_depto WHERE (([id_depto] = @Original_id_depto) AND ((@IsNull_nom_depto = 1 AND [nom_depto] IS NULL) OR ([nom_depto] = @Original_nom_depto)));
          Source: QxVf0A9SFT.exeBinary or memory string: INSERT INTO [DEPTO] ([id_depto], [nom_depto]) VALUES (@id_depto, @nom_depto); SELECT id_depto, nom_depto FROM DEPTO WHERE (id_dept
          Source: QxVf0A9SFT.exeBinary or memory string: INSERT INTO [SUCURSAL] ([id_sucursal], [nom_sucursal]) VALUES (@id_sucursal, @nom_sucursal); SELECT id_sucursal, nom_sucursal FROM
          Source: QxVf0A9SFT.exeVirustotal: Detection: 44%
          Source: unknownProcess created: C:\Users\user\Desktop\QxVf0A9SFT.exe 'C:\Users\user\Desktop\QxVf0A9SFT.exe'
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess created: C:\Users\user\Desktop\QxVf0A9SFT.exe C:\Users\user\Desktop\QxVf0A9SFT.exe
          Source: C:\Windows\explorer.exeProcess created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe'
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess created: C:\Users\user\Desktop\QxVf0A9SFT.exe C:\Users\user\Desktop\QxVf0A9SFT.exeJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\QxVf0A9SFT.exe'Jump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
          Source: QxVf0A9SFT.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: QxVf0A9SFT.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: cmstp.pdbGCTL source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
          Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp
          Source: Binary string: wntdll.pdbUGP source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe, 00000015.00000002.502745241.00000000044F0000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: QxVf0A9SFT.exe, 00000012.00000002.368123180.0000000001AEF000.00000040.00000001.sdmp, cmstp.exe
          Source: Binary string: cmstp.pdb source: QxVf0A9SFT.exe, 00000012.00000002.367313911.0000000001920000.00000040.00000001.sdmp
          Source: Binary string: wscui.pdb source: explorer.exe, 00000014.00000000.336398999.000000000EC20000.00000002.00000001.sdmp
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B2A2 push cs; ret 18_2_0041B2A3
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B3F2 push eax; ret 18_2_0041B3F8
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B3FB push eax; ret 18_2_0041B462
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B3A5 push eax; ret 18_2_0041B3F8
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041B45C push eax; ret 18_2_0041B462
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00415414 push esp; ret 18_2_00415416
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00414F46 push cs; ret 18_2_00414F47
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_0041BF12 push dword ptr [8427D5C5h]; ret 18_2_0041C1FF
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00415FC5 push ebp; ret 18_2_00415FC6
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00E4C06A push 00000000h; iretd 18_2_00E4C0B4
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_00E447A5 push es; iretd 18_2_00E44A13
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_0456D0D1 push ecx; ret 21_2_0456D0E4
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B2A2 push cs; ret 21_2_02B7B2A3
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B3A5 push eax; ret 21_2_02B7B3F8
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B3F2 push eax; ret 21_2_02B7B3F8
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B3FB push eax; ret 21_2_02B7B462
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B75FC5 push ebp; ret 21_2_02B75FC6
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7BF12 push dword ptr [8427D5C5h]; ret 21_2_02B7C1FF
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B74F46 push cs; ret 21_2_02B74F47
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B75414 push esp; ret 21_2_02B75416
          Source: C:\Windows\SysWOW64\cmstp.exeCode function: 21_2_02B7B45C push eax; ret 21_2_02B7B462
          Source: initial sampleStatic PE information: section name: .text entropy: 7.2914561849
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\cmstp.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

          Malware Analysis System Evasion:

          barindex
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeRDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeRDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmstp.exeRDTSC instruction interceptor: First address: 0000000002B685E4 second address: 0000000002B685EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\cmstp.exeRDTSC instruction interceptor: First address: 0000000002B6896E second address: 0000000002B68974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeCode function: 18_2_004088A0 rdtsc 18_2_004088A0
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exe TID: 2200Thread sleep time: -48661s >= -30000sJump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exe TID: 5508Thread sleep time: -922337203685477s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exeLast function: Thread delayed
          Source: C:\Windows\SysWOW64\cmstp.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeThread delayed: delay time: 48661Jump to behavior
          Source: C:\Users\user\Desktop\QxVf0A9SFT.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000014.00000000.329623748.000000000891C000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00dRom0
          Source: explorer.exe, 00000014.00000000.315086166.0000000003710000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000014.00000000.328359455.0000000008270000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
          Source: QxVf0A9SFT.exeBinary or memory string: zE[TiU[]qET]m8Z\3QqeMU[]K<IgogJD|YJg4E[eyQ3[3Y5]DL6e3Q5\xDjfoUZd5<pfTU6\osp\SQ[]mopg|Y5XlY5Y843[wEjfoUZd5<pfTU6\osp\SQ[e|<pU843[wEjfoQ[YDL[]nopgyMKX3QZ]tM5W|Y5fY<YeDL[]nopgyMKX3QZ]tM5WzE[Ti4JD|YJ]s]6e|EIgmYpdl<nfoU[gz45eG<YeDPZeV]WerYHWsYZfGgmTWg4U3EzTqEqVWooe
          Source: explorer.exe, 00000014.00000000.330513195.0000000008A9D000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0