Windows Analysis Report pMbPS8nCm1.exe

Overview

General Information

Sample Name: pMbPS8nCm1.exe
Analysis ID: 452687
MD5: de87f1794377537dda721afd9137e491
SHA1: 3b0480a4afe176722d9b8cf6f9f9c9257b1d132f
SHA256: b0a684c7dfc5a94e3dd2edcb1c706eae088ff9d701ec55f0adb1ae977e5e9081
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.aizaibali.com/ Avira URL Cloud: Label: malware
Source: http://www.wideawakemomma.com/dy8g/?i8PHMrf=n9TsU/XZirCaXaeSUYbcU/ldcwtyxBDUqcAV1OuBRveQ+2sj4hTKAs/tsBNJEPRO40QM&5jLtOl=htxh Avira URL Cloud: Label: malware
Source: http://www.aizaibali.com/dy8g/?i8PHMrf=iLV9pktedYDy4Ry4OVO/uadmgyKbVGN Avira URL Cloud: Label: malware
Found malware configuration
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.extinctionbrews.com/dy8g/"], "decoy": ["mzyxi-rkah-y.net", "okinawarongnho.com", "qq66520.com", "nimbus.watch", "cwdelrio.com", "regalshopper.com", "avito-payment.life", "jorgeporcayo.com", "galvinsky.digital", "guys-only.com", "asmfruits-almacenes.com", "boatrace-life04.net", "cochez.club", "thelastvictor.net", "janieleconte.com", "ivoirepneus.com", "saludflv.info", "mydreamtv.net", "austinphy.com", "cajunseafoodstcloud.com", "13006608192.com", "clear3media.com", "thegrowclinic.com", "findfoodshop.com", "livegaming.store", "greensei.com", "atmaapothecary.com", "builtbydawn.com", "wthcoffee.com", "melodezu.com", "oikoschain.com", "matcitekids.com", "killrstudio.com", "doityourselfism.com", "monsoonnerd.com", "swissbankmusic.com", "envisionfordheights.com", "invisiongc.net", "aizaibali.com", "professioneconsulenza.net", "chaneabond.com", "theamercianhouseboat.com", "scuolatua.com", "surivaganza.com", "xn--vuq722jwngjre.com", "quiteimediato.space", "ecofingers.com", "manageoceanaccount.com", "cindywillardrealtor.com", "garimpeirastore.online", "tinsley.website", "fitnesstwentytwenty.com", "thenorthgoldline.com", "scuolacounselingroma.com", "iwccgroup.com", "wideawakemomma.com", "anthonysavillemiddleschool.com", "sprinkleresources.com", "ravexim3.com", "onedadtwodudes.com", "shxytl.com", "iriscloudvideo.com", "theshapecreator.com", "vermogenswerte.com"]}
Multi AV Scanner detection for submitted file
Source: pMbPS8nCm1.exe Virustotal: Detection: 26% Perma Link
Source: pMbPS8nCm1.exe ReversingLabs: Detection: 41%
Yara detected FormBook
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Machine Learning detection for sample
Source: pMbPS8nCm1.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 13.2.raserver.exe.302d450.3.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.pMbPS8nCm1.exe.5a0000.2.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 13.2.raserver.exe.5167960.6.unpack Avira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Uses 32bit PE files
Source: pMbPS8nCm1.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: Binary string: wntdll.pdbUGP source: pMbPS8nCm1.exe, 00000001.00000003.245067685.0000000002480000.00000004.00000001.sdmp, pMbPS8nCm1.exe, 00000002.00000002.306527493.0000000000A10000.00000040.00000001.sdmp, raserver.exe, 0000000D.00000002.511116133.0000000004D4F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: pMbPS8nCm1.exe, raserver.exe
Source: Binary string: RAServer.pdb source: pMbPS8nCm1.exe, 00000002.00000002.308172933.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: RAServer.pdbGCTL source: pMbPS8nCm1.exe, 00000002.00000002.308172933.0000000000D70000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 4x nop then pop esi 2_2_00415852
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 4x nop then pop ebx 2_2_00406A98
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 4x nop then pop edi 2_2_00415699
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop esi 13_2_009B5852
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop ebx 13_2_009A6A99
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop edi 13_2_009B5699

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49735 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49735 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49735 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49739 -> 172.104.157.41:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49739 -> 172.104.157.41:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49739 -> 172.104.157.41:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49743 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49743 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49743 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49745 -> 209.99.40.222:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49745 -> 209.99.40.222:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49745 -> 209.99.40.222:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.extinctionbrews.com/dy8g/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=M2y08b4guDc7ky1UfP9B2E9DVQMkOM+mjhyUMO8ZT8ajlM0broLEOhQJKgG+gbTLwEQu&5jLtOl=htxh HTTP/1.1Host: www.cochez.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=d70oYrFBgMb8Os9vLLnU0lHHdKTBSZLAimar8DFO2VzVjiqJdJvZleKp8o5Ll6MGkmh7&5jLtOl=htxh HTTP/1.1Host: www.cindywillardrealtor.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=n9TsU/XZirCaXaeSUYbcU/ldcwtyxBDUqcAV1OuBRveQ+2sj4hTKAs/tsBNJEPRO40QM&5jLtOl=htxh HTTP/1.1Host: www.wideawakemomma.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=vEc9l3KIwUbL2yE9akOYH6tpFpdH8sidHZA37HjQYo0aYTivi/dQORBe2IJ6crCUqb4r&5jLtOl=htxh HTTP/1.1Host: www.vermogenswerte.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=ECrCAtcV2n6MmfvkEdEbFHcY5Y6SYRzoX56/iPQe4p5qRx/lRHZ+fK1TxUEBZfQE2R2Q&5jLtOl=htxh HTTP/1.1Host: www.thenorthgoldline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoGD3PCL74z9p&5jLtOl=htxh HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 95.215.210.10 95.215.210.10
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: NEWIT-ASRU NEWIT-ASRU
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=M2y08b4guDc7ky1UfP9B2E9DVQMkOM+mjhyUMO8ZT8ajlM0broLEOhQJKgG+gbTLwEQu&5jLtOl=htxh HTTP/1.1Host: www.cochez.clubConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=d70oYrFBgMb8Os9vLLnU0lHHdKTBSZLAimar8DFO2VzVjiqJdJvZleKp8o5Ll6MGkmh7&5jLtOl=htxh HTTP/1.1Host: www.cindywillardrealtor.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=n9TsU/XZirCaXaeSUYbcU/ldcwtyxBDUqcAV1OuBRveQ+2sj4hTKAs/tsBNJEPRO40QM&5jLtOl=htxh HTTP/1.1Host: www.wideawakemomma.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=vEc9l3KIwUbL2yE9akOYH6tpFpdH8sidHZA37HjQYo0aYTivi/dQORBe2IJ6crCUqb4r&5jLtOl=htxh HTTP/1.1Host: www.vermogenswerte.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=ECrCAtcV2n6MmfvkEdEbFHcY5Y6SYRzoX56/iPQe4p5qRx/lRHZ+fK1TxUEBZfQE2R2Q&5jLtOl=htxh HTTP/1.1Host: www.thenorthgoldline.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /dy8g/?i8PHMrf=DjnY/S7/G1yk/GGdjnbMG0pwlAlipgBY8a8MDSEvYTAaE8/8s3MkSQswoGD3PCL74z9p&5jLtOl=htxh HTTP/1.1Host: www.extinctionbrews.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.cochez.club
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 22 Jul 2021 16:05:24 GMTServer: Apache/2.4.6 (CentOS) PHP/7.3.19Content-Length: 203Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 64 79 38 67 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /dy8g/ was not found on this server.</p></body></html>
Source: raserver.exe, 0000000D.00000002.513072851.00000000052E2000.00000004.00000001.sdmp String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: raserver.exe, 0000000D.00000002.509297575.0000000003078000.00000004.00000020.sdmp String found in binary or memory: http://www.aizaibali.com/
Source: raserver.exe, 0000000D.00000002.509297575.0000000003078000.00000004.00000020.sdmp String found in binary or memory: http://www.aizaibali.com/dy8g/?i8PHMrf=iLV9pktedYDy4Ry4OVO/uadmgyKbVGN
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.272445649.000000000BC36000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: pMbPS8nCm1.exe, 00000001.00000002.248667021.000000000078A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004181D0 NtCreateFile, 2_2_004181D0
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00418280 NtReadFile, 2_2_00418280
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00418300 NtClose, 2_2_00418300
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004183B0 NtAllocateVirtualMemory, 2_2_004183B0
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00418222 NtCreateFile, 2_2_00418222
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004183AA NtAllocateVirtualMemory, 2_2_004183AA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99840 NtDelayExecution,LdrInitializeThunk, 13_2_04C99840
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99860 NtQuerySystemInformation,LdrInitializeThunk, 13_2_04C99860
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C995D0 NtClose,LdrInitializeThunk, 13_2_04C995D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C999A0 NtCreateSection,LdrInitializeThunk, 13_2_04C999A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99540 NtReadFile,LdrInitializeThunk, 13_2_04C99540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 13_2_04C99910
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C996D0 NtCreateKey,LdrInitializeThunk, 13_2_04C996D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C996E0 NtFreeVirtualMemory,LdrInitializeThunk, 13_2_04C996E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99A50 NtCreateFile,LdrInitializeThunk, 13_2_04C99A50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99650 NtQueryValueKey,LdrInitializeThunk, 13_2_04C99650
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99660 NtAllocateVirtualMemory,LdrInitializeThunk, 13_2_04C99660
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99FE0 NtCreateMutant,LdrInitializeThunk, 13_2_04C99FE0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99780 NtMapViewOfSection,LdrInitializeThunk, 13_2_04C99780
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99710 NtQueryInformationToken,LdrInitializeThunk, 13_2_04C99710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C998F0 NtReadVirtualMemory, 13_2_04C998F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C998A0 NtWriteVirtualMemory, 13_2_04C998A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9B040 NtSuspendThread, 13_2_04C9B040
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99820 NtEnumerateKey, 13_2_04C99820
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C999D0 NtCreateProcessEx, 13_2_04C999D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C995F0 NtQueryInformationFile, 13_2_04C995F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99950 NtQueueApcThread, 13_2_04C99950
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99560 NtWriteFile, 13_2_04C99560
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99520 NtWaitForSingleObject, 13_2_04C99520
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9AD30 NtSetContextThread, 13_2_04C9AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99A80 NtOpenDirectoryObject, 13_2_04C99A80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99670 NtQueryInformationProcess, 13_2_04C99670
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99A00 NtProtectVirtualMemory, 13_2_04C99A00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99610 NtEnumerateValueKey, 13_2_04C99610
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99A10 NtQuerySection, 13_2_04C99A10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99A20 NtResumeThread, 13_2_04C99A20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C997A0 NtUnmapViewOfSection, 13_2_04C997A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9A3B0 NtGetContextThread, 13_2_04C9A3B0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99760 NtOpenProcess, 13_2_04C99760
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99770 NtSetInformationFile, 13_2_04C99770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9A770 NtOpenThread, 13_2_04C9A770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99B00 NtSetValueKey, 13_2_04C99B00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9A710 NtOpenProcessToken, 13_2_04C9A710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C99730 NtQueryVirtualMemory, 13_2_04C99730
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B81D0 NtCreateFile, 13_2_009B81D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B8280 NtReadFile, 13_2_009B8280
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B83B0 NtAllocateVirtualMemory, 13_2_009B83B0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B8300 NtClose, 13_2_009B8300
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B8222 NtCreateFile, 13_2_009B8222
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B83AA NtAllocateVirtualMemory, 13_2_009B83AA
Detected potential crypto function
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0040102E 2_2_0040102E
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B8FB 2_2_0041B8FB
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00408C6C 2_2_00408C6C
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00408C70 2_2_00408C70
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B57A 2_2_0041B57A
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00402D88 2_2_00402D88
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041C58A 2_2_0041C58A
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6B090 13_2_04C6B090
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11002 13_2_04D11002
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6841F 13_2_04C6841F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6D5E0 13_2_04C6D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D21D55 13_2_04D21D55
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5F900 13_2_04C5F900
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C50D20 13_2_04C50D20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C76E30 13_2_04C76E30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8EBB0 13_2_04C8EBB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB8FB 13_2_009BB8FB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A8C70 13_2_009A8C70
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A8C6C 13_2_009A8C6C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A2D90 13_2_009A2D90
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BC58A 13_2_009BC58A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A2D88 13_2_009A2D88
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB57A 13_2_009BB57A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A2FB0 13_2_009A2FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 04C5B150 appears 32 times
Sample file is different than original file name gathered from version info
Source: pMbPS8nCm1.exe, 00000001.00000003.243940877.0000000002406000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs pMbPS8nCm1.exe
Source: pMbPS8nCm1.exe, 00000002.00000002.307872984.0000000000CBF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs pMbPS8nCm1.exe
Source: pMbPS8nCm1.exe, 00000002.00000002.308207312.0000000000D89000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameraserver.exej% vs pMbPS8nCm1.exe
Uses 32bit PE files
Source: pMbPS8nCm1.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Yara signature match
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/0@13/5
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2196:120:WilError_01
Source: pMbPS8nCm1.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: pMbPS8nCm1.exe Virustotal: Detection: 26%
Source: pMbPS8nCm1.exe ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe File read: C:\Users\user\Desktop\pMbPS8nCm1.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\pMbPS8nCm1.exe 'C:\Users\user\Desktop\pMbPS8nCm1.exe'
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process created: C:\Users\user\Desktop\pMbPS8nCm1.exe 'C:\Users\user\Desktop\pMbPS8nCm1.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pMbPS8nCm1.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process created: C:\Users\user\Desktop\pMbPS8nCm1.exe 'C:\Users\user\Desktop\pMbPS8nCm1.exe' Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pMbPS8nCm1.exe' Jump to behavior
Source: Binary string: wntdll.pdbUGP source: pMbPS8nCm1.exe, 00000001.00000003.245067685.0000000002480000.00000004.00000001.sdmp, pMbPS8nCm1.exe, 00000002.00000002.306527493.0000000000A10000.00000040.00000001.sdmp, raserver.exe, 0000000D.00000002.511116133.0000000004D4F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: pMbPS8nCm1.exe, raserver.exe
Source: Binary string: RAServer.pdb source: pMbPS8nCm1.exe, 00000002.00000002.308172933.0000000000D70000.00000040.00000001.sdmp
Source: Binary string: RAServer.pdbGCTL source: pMbPS8nCm1.exe, 00000002.00000002.308172933.0000000000D70000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Unpacked PE file: 2.2.pMbPS8nCm1.exe.400000.0.unpack .text:ER;.rdata:R; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004062F6 pushfd ; ret 2_2_004062F7
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B3C5 push eax; ret 2_2_0041B418
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004153FC push eax; retf 2_2_0041540B
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B47C push eax; ret 2_2_0041B482
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B412 push eax; ret 2_2_0041B418
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041B41B push eax; ret 2_2_0041B482
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00415CE7 pushad ; ret 2_2_00415D4B
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_0041C4EE push 133511A3h; retf 2_2_0041C4F3
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00414D71 push ss; iretd 2_2_00414D72
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00415D38 pushad ; ret 2_2_00415D4B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CAD0D1 push ecx; ret 13_2_04CAD0E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009A62F6 pushfd ; ret 13_2_009A62F7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB3C5 push eax; ret 13_2_009BB418
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B53FC push eax; retf 13_2_009B540B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BC4EE push 133511A3h; retf 13_2_009BC4F3
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B5CE7 pushad ; ret 13_2_009B5D4B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB41B push eax; ret 13_2_009BB482
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB412 push eax; ret 13_2_009BB418
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009BB47C push eax; ret 13_2_009BB482
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B5D38 pushad ; ret 13_2_009B5D4B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_009B4D71 push ss; iretd 13_2_009B4D72
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 00000000009A85F4 second address: 00000000009A85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 00000000009A898E second address: 00000000009A8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004088C0 rdtsc 2_2_004088C0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 5164 Thread sleep time: -45000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 4616 Thread sleep time: -42000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Source: explorer.exe, 00000003.00000000.283051381.000000000113D000.00000004.00000020.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: explorer.exe, 00000003.00000000.269510114.000000000891C000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.267438419.0000000008270000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: raserver.exe, 0000000D.00000002.509359980.000000000308F000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW+^
Source: raserver.exe, 0000000D.00000002.509236536.0000000003062000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000003.00000000.283272252.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000003.00000000.269723701.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000003.00000000.261687193.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000003.00000000.267438419.0000000008270000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.267438419.0000000008270000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.269723701.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: explorer.exe, 00000003.00000000.267438419.0000000008270000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_004088C0 rdtsc 2_2_004088C0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 2_2_00409B30 LdrLoadDll, 2_2_00409B30
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 1_2_006E06DA mov eax, dword ptr fs:[00000030h] 1_2_006E06DA
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 1_2_006E08EE mov eax, dword ptr fs:[00000030h] 1_2_006E08EE
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 1_2_006E09DE mov eax, dword ptr fs:[00000030h] 1_2_006E09DE
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 1_2_006E099F mov eax, dword ptr fs:[00000030h] 1_2_006E099F
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Code function: 1_2_006E0A1C mov eax, dword ptr fs:[00000030h] 1_2_006E0A1C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28CD6 mov eax, dword ptr fs:[00000030h] 13_2_04D28CD6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov ecx, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEB8D0 mov eax, dword ptr fs:[00000030h] 13_2_04CEB8D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D114FB mov eax, dword ptr fs:[00000030h] 13_2_04D114FB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] 13_2_04CD6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] 13_2_04CD6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6CF0 mov eax, dword ptr fs:[00000030h] 13_2_04CD6CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59080 mov eax, dword ptr fs:[00000030h] 13_2_04C59080
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD3884 mov eax, dword ptr fs:[00000030h] 13_2_04CD3884
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD3884 mov eax, dword ptr fs:[00000030h] 13_2_04CD3884
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6849B mov eax, dword ptr fs:[00000030h] 13_2_04C6849B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C990AF mov eax, dword ptr fs:[00000030h] 13_2_04C990AF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8F0BF mov ecx, dword ptr fs:[00000030h] 13_2_04C8F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8F0BF mov eax, dword ptr fs:[00000030h] 13_2_04C8F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8F0BF mov eax, dword ptr fs:[00000030h] 13_2_04C8F0BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A44B mov eax, dword ptr fs:[00000030h] 13_2_04C8A44B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C70050 mov eax, dword ptr fs:[00000030h] 13_2_04C70050
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C70050 mov eax, dword ptr fs:[00000030h] 13_2_04C70050
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEC450 mov eax, dword ptr fs:[00000030h] 13_2_04CEC450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEC450 mov eax, dword ptr fs:[00000030h] 13_2_04CEC450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D12073 mov eax, dword ptr fs:[00000030h] 13_2_04D12073
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D21074 mov eax, dword ptr fs:[00000030h] 13_2_04D21074
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7746D mov eax, dword ptr fs:[00000030h] 13_2_04C7746D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D24015 mov eax, dword ptr fs:[00000030h] 13_2_04D24015
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D24015 mov eax, dword ptr fs:[00000030h] 13_2_04D24015
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] 13_2_04CD6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] 13_2_04CD6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] 13_2_04CD6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD6C0A mov eax, dword ptr fs:[00000030h] 13_2_04CD6C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D11C06 mov eax, dword ptr fs:[00000030h] 13_2_04D11C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] 13_2_04CD7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] 13_2_04CD7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7016 mov eax, dword ptr fs:[00000030h] 13_2_04CD7016
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] 13_2_04D2740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] 13_2_04D2740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D2740D mov eax, dword ptr fs:[00000030h] 13_2_04D2740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8BC2C mov eax, dword ptr fs:[00000030h] 13_2_04C8BC2C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] 13_2_04C8002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] 13_2_04C8002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] 13_2_04C8002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] 13_2_04C8002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8002D mov eax, dword ptr fs:[00000030h] 13_2_04C8002D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] 13_2_04C6B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] 13_2_04C6B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] 13_2_04C6B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6B02A mov eax, dword ptr fs:[00000030h] 13_2_04C6B02A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D08DF1 mov eax, dword ptr fs:[00000030h] 13_2_04D08DF1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] 13_2_04C5B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] 13_2_04C5B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5B1E1 mov eax, dword ptr fs:[00000030h] 13_2_04C5B1E1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CE41E8 mov eax, dword ptr fs:[00000030h] 13_2_04CE41E8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6D5E0 mov eax, dword ptr fs:[00000030h] 13_2_04C6D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6D5E0 mov eax, dword ptr fs:[00000030h] 13_2_04C6D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7C182 mov eax, dword ptr fs:[00000030h] 13_2_04C7C182
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A185 mov eax, dword ptr fs:[00000030h] 13_2_04C8A185
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] 13_2_04C52D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] 13_2_04C52D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] 13_2_04C52D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] 13_2_04C52D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C52D8A mov eax, dword ptr fs:[00000030h] 13_2_04C52D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8FD9B mov eax, dword ptr fs:[00000030h] 13_2_04C8FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8FD9B mov eax, dword ptr fs:[00000030h] 13_2_04C8FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C82990 mov eax, dword ptr fs:[00000030h] 13_2_04C82990
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C861A0 mov eax, dword ptr fs:[00000030h] 13_2_04C861A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C861A0 mov eax, dword ptr fs:[00000030h] 13_2_04C861A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C835A1 mov eax, dword ptr fs:[00000030h] 13_2_04C835A1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD69A6 mov eax, dword ptr fs:[00000030h] 13_2_04CD69A6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] 13_2_04CD51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] 13_2_04CD51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] 13_2_04CD51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD51BE mov eax, dword ptr fs:[00000030h] 13_2_04CD51BE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] 13_2_04C81DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] 13_2_04C81DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C81DB5 mov eax, dword ptr fs:[00000030h] 13_2_04C81DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7B944 mov eax, dword ptr fs:[00000030h] 13_2_04C7B944
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7B944 mov eax, dword ptr fs:[00000030h] 13_2_04C7B944
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C93D43 mov eax, dword ptr fs:[00000030h] 13_2_04C93D43
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD3540 mov eax, dword ptr fs:[00000030h] 13_2_04CD3540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C77D50 mov eax, dword ptr fs:[00000030h] 13_2_04C77D50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5C962 mov eax, dword ptr fs:[00000030h] 13_2_04C5C962
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7C577 mov eax, dword ptr fs:[00000030h] 13_2_04C7C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7C577 mov eax, dword ptr fs:[00000030h] 13_2_04C7C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5B171 mov eax, dword ptr fs:[00000030h] 13_2_04C5B171
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5B171 mov eax, dword ptr fs:[00000030h] 13_2_04C5B171
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] 13_2_04C59100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] 13_2_04C59100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59100 mov eax, dword ptr fs:[00000030h] 13_2_04C59100
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28D34 mov eax, dword ptr fs:[00000030h] 13_2_04D28D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 mov eax, dword ptr fs:[00000030h] 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C74120 mov ecx, dword ptr fs:[00000030h] 13_2_04C74120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8513A mov eax, dword ptr fs:[00000030h] 13_2_04C8513A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8513A mov eax, dword ptr fs:[00000030h] 13_2_04C8513A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C63D34 mov eax, dword ptr fs:[00000030h] 13_2_04C63D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] 13_2_04C84D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] 13_2_04C84D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C84D3B mov eax, dword ptr fs:[00000030h] 13_2_04C84D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5AD30 mov eax, dword ptr fs:[00000030h] 13_2_04C5AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CDA537 mov eax, dword ptr fs:[00000030h] 13_2_04CDA537
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C82ACB mov eax, dword ptr fs:[00000030h] 13_2_04C82ACB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28ED6 mov eax, dword ptr fs:[00000030h] 13_2_04D28ED6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C836CC mov eax, dword ptr fs:[00000030h] 13_2_04C836CC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C98EC7 mov eax, dword ptr fs:[00000030h] 13_2_04C98EC7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D0FEC0 mov eax, dword ptr fs:[00000030h] 13_2_04D0FEC0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C676E2 mov eax, dword ptr fs:[00000030h] 13_2_04C676E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C816E0 mov ecx, dword ptr fs:[00000030h] 13_2_04C816E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C82AE4 mov eax, dword ptr fs:[00000030h] 13_2_04C82AE4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEFE87 mov eax, dword ptr fs:[00000030h] 13_2_04CEFE87
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8D294 mov eax, dword ptr fs:[00000030h] 13_2_04C8D294
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8D294 mov eax, dword ptr fs:[00000030h] 13_2_04C8D294
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] 13_2_04C552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] 13_2_04C552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] 13_2_04C552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] 13_2_04C552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C552A5 mov eax, dword ptr fs:[00000030h] 13_2_04C552A5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD46A7 mov eax, dword ptr fs:[00000030h] 13_2_04CD46A7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6AAB0 mov eax, dword ptr fs:[00000030h] 13_2_04C6AAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6AAB0 mov eax, dword ptr fs:[00000030h] 13_2_04C6AAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] 13_2_04D20EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] 13_2_04D20EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D20EA5 mov eax, dword ptr fs:[00000030h] 13_2_04D20EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8FAB0 mov eax, dword ptr fs:[00000030h] 13_2_04C8FAB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] 13_2_04C59240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] 13_2_04C59240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] 13_2_04C59240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C59240 mov eax, dword ptr fs:[00000030h] 13_2_04C59240
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C67E41 mov eax, dword ptr fs:[00000030h] 13_2_04C67E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CE4257 mov eax, dword ptr fs:[00000030h] 13_2_04CE4257
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6766D mov eax, dword ptr fs:[00000030h] 13_2_04C6766D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D0B260 mov eax, dword ptr fs:[00000030h] 13_2_04D0B260
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D0B260 mov eax, dword ptr fs:[00000030h] 13_2_04D0B260
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28A62 mov eax, dword ptr fs:[00000030h] 13_2_04D28A62
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C9927A mov eax, dword ptr fs:[00000030h] 13_2_04C9927A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] 13_2_04C7AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] 13_2_04C7AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] 13_2_04C7AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] 13_2_04C7AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7AE73 mov eax, dword ptr fs:[00000030h] 13_2_04C7AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] 13_2_04C5C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] 13_2_04C5C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5C600 mov eax, dword ptr fs:[00000030h] 13_2_04C5C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C88E00 mov eax, dword ptr fs:[00000030h] 13_2_04C88E00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C68A0A mov eax, dword ptr fs:[00000030h] 13_2_04C68A0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5AA16 mov eax, dword ptr fs:[00000030h] 13_2_04C5AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5AA16 mov eax, dword ptr fs:[00000030h] 13_2_04C5AA16
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A61C mov eax, dword ptr fs:[00000030h] 13_2_04C8A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A61C mov eax, dword ptr fs:[00000030h] 13_2_04C8A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C73A1C mov eax, dword ptr fs:[00000030h] 13_2_04C73A1C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5E620 mov eax, dword ptr fs:[00000030h] 13_2_04C5E620
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D0FE3F mov eax, dword ptr fs:[00000030h] 13_2_04D0FE3F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD53CA mov eax, dword ptr fs:[00000030h] 13_2_04CD53CA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD53CA mov eax, dword ptr fs:[00000030h] 13_2_04CD53CA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C803E2 mov eax, dword ptr fs:[00000030h] 13_2_04C803E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C937F5 mov eax, dword ptr fs:[00000030h] 13_2_04C937F5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C61B8F mov eax, dword ptr fs:[00000030h] 13_2_04C61B8F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C61B8F mov eax, dword ptr fs:[00000030h] 13_2_04C61B8F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D0D380 mov ecx, dword ptr fs:[00000030h] 13_2_04D0D380
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C68794 mov eax, dword ptr fs:[00000030h] 13_2_04C68794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8B390 mov eax, dword ptr fs:[00000030h] 13_2_04C8B390
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] 13_2_04CD7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] 13_2_04CD7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CD7794 mov eax, dword ptr fs:[00000030h] 13_2_04CD7794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D1138A mov eax, dword ptr fs:[00000030h] 13_2_04D1138A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D25BA5 mov eax, dword ptr fs:[00000030h] 13_2_04D25BA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5DB40 mov eax, dword ptr fs:[00000030h] 13_2_04C5DB40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6EF40 mov eax, dword ptr fs:[00000030h] 13_2_04C6EF40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28B58 mov eax, dword ptr fs:[00000030h] 13_2_04D28B58
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5F358 mov eax, dword ptr fs:[00000030h] 13_2_04C5F358
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C5DB60 mov ecx, dword ptr fs:[00000030h] 13_2_04C5DB60
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C6FF60 mov eax, dword ptr fs:[00000030h] 13_2_04C6FF60
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C83B7A mov eax, dword ptr fs:[00000030h] 13_2_04C83B7A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C83B7A mov eax, dword ptr fs:[00000030h] 13_2_04C83B7A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D28F6A mov eax, dword ptr fs:[00000030h] 13_2_04D28F6A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A70E mov eax, dword ptr fs:[00000030h] 13_2_04C8A70E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8A70E mov eax, dword ptr fs:[00000030h] 13_2_04C8A70E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D1131B mov eax, dword ptr fs:[00000030h] 13_2_04D1131B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C7F716 mov eax, dword ptr fs:[00000030h] 13_2_04C7F716
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEFF10 mov eax, dword ptr fs:[00000030h] 13_2_04CEFF10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04CEFF10 mov eax, dword ptr fs:[00000030h] 13_2_04CEFF10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D2070D mov eax, dword ptr fs:[00000030h] 13_2_04D2070D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04D2070D mov eax, dword ptr fs:[00000030h] 13_2_04D2070D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C54F2E mov eax, dword ptr fs:[00000030h] 13_2_04C54F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C54F2E mov eax, dword ptr fs:[00000030h] 13_2_04C54F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 13_2_04C8E730 mov eax, dword ptr fs:[00000030h] 13_2_04C8E730
Enables debug privileges
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.thenorthgoldline.com
Source: C:\Windows\explorer.exe Domain query: www.cochez.club
Source: C:\Windows\explorer.exe Domain query: www.vermogenswerte.com
Source: C:\Windows\explorer.exe Domain query: www.aizaibali.com
Source: C:\Windows\explorer.exe Domain query: www.extinctionbrews.com
Source: C:\Windows\explorer.exe Network Connect: 95.215.210.10 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.boatrace-life04.net
Source: C:\Windows\explorer.exe Network Connect: 172.104.157.41 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.cindywillardrealtor.com
Source: C:\Windows\explorer.exe Domain query: www.wideawakemomma.com
Source: C:\Windows\explorer.exe Domain query: www.livegaming.store
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 75.2.81.221 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 154.88.31.204 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.saludflv.info
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Section loaded: unknown target: C:\Users\user\Desktop\pMbPS8nCm1.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Thread register set: target process: 3472 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: EB0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\pMbPS8nCm1.exe Process created: C:\Users\user\Desktop\pMbPS8nCm1.exe 'C:\Users\user\Desktop\pMbPS8nCm1.exe' Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\pMbPS8nCm1.exe' Jump to behavior
Source: explorer.exe, 00000003.00000000.283537676.0000000001640000.00000002.00000001.sdmp, raserver.exe, 0000000D.00000002.509596588.00000000034E0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.283537676.0000000001640000.00000002.00000001.sdmp, raserver.exe, 0000000D.00000002.509596588.00000000034E0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.283537676.0000000001640000.00000002.00000001.sdmp, raserver.exe, 0000000D.00000002.509596588.00000000034E0000.00000002.00000001.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000003.00000000.251221123.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000003.00000000.283537676.0000000001640000.00000002.00000001.sdmp, raserver.exe, 0000000D.00000002.509596588.00000000034E0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000003.00000000.283537676.0000000001640000.00000002.00000001.sdmp, raserver.exe, 0000000D.00000002.509596588.00000000034E0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.pMbPS8nCm1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.pMbPS8nCm1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.pMbPS8nCm1.exe.6f0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.508769679.0000000002FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.248608890.00000000006F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.306388335.00000000009E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305709350.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.509446252.00000000032A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.246218201.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.506978172.00000000009A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.305134983.0000000000400000.00000040.00000001.sdmp, type: MEMORY
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs