Play interactive tour

Edit tour

Windows Analysis Report Auftragsbest#U00e4tigung Dringend.exe

Overview

General Information

Sample Name:	Auftragsbest#U00e4tigung Dringend.exe
Analysis ID:	491651
MD5:	b8d99b6c405fc56bd8a1448421d64eac
SHA1:	0ba8da5d51a77798010e6b1a2a8e759c8bcbe7fa
SHA256:	e2bf9e2c787866d86fc1ae939c378f7d22fab268a00ae163fff1b79332df2088
Tags:	exeRATRemcosRAT
Infos:
Most interesting Screenshot:

Detection

DBatLoader

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected DBatLoader

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

One or more processes crash

PE file contains strange resources

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Classification

Process Tree

System is w10x64

Auftragsbest#U00e4tigung Dringend.exe (PID: 6584 cmdline: 'C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe' MD5: B8D99B6C405FC56BD8A1448421D64EAC)

WerFault.exe (PID: 7008 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 1968 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.358219235.0000000002414000.00000004.00000001.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000001.00000002.398644926.0000000002414000.00000004.00000001.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000001.00000000.361969007.0000000002414000.00000004.00000001.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Auftragsbest#U00e4tigung Dringend.exe	Virustotal: Detection: 59%	Perma Link
Source: Auftragsbest#U00e4tigung Dringend.exe	Metadefender: Detection: 40%	Perma Link
Source: Auftragsbest#U00e4tigung Dringend.exe	ReversingLabs: Detection: 78%

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Unpacked PE file: 1.2.Auftragsbest#U00e4tigung Dringend.exe.400000.0.unpack

Source: Auftragsbest#U00e4tigung Dringend.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdbWQY# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.369075881.00000000046DB000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdbm& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbgQ)#" source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbaQ3#! source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.368777417.000000000056A000.00000004.00000001.sdmp
Source:	Binary string: crypt32.pdbyQK# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb!& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb%Qw# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbc& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb?& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb{& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: gpapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbS& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb]& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb5& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000004.00000003.368353281.0000000000564000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdbuQG# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb4 source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: ncryptsslp.pdbMQ_# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbO& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbq& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbE& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb; source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb7 source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdbQQc# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000004.00000003.369145029.000000000055E000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb+& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb'& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbw& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb[Qm# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdbI& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.368777417.000000000056A000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb7 source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp

Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350639657.0000000000870000.00000004.00000001.sdmp, WerFault.exe, 00000004.00000003.395170919.0000000004609000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: http://explore.live.com/windows-live-sign-in-
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: http://explore.live.com/windows-live-sign-in-single-use-code-faq
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.liv
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/ChangePassword?uaid=dc8fa6b4c18946c2b26a42c526ae2a5f
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/ResetPassword.aspx?wreply=https://login.live.com/login.srf%3fwa%3dwsignin1.
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/query.aspx?uaid=dc8fa6b4c18946c2b26a42c526ae2a5f&mkt=EN-US&lc=1033&id=25020
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/security/LoginStage.aspx?lmif=1000&ru
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/security/LoginStage.aspx?lmif=1000&ru=https://login.live.com/login.srf%3Fwa
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/username/recover?wreply=https://login.live.c
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://account.live.com/username/recover?wreply=https://login.live.com/login.srf%3flc%3d1033%26mkt%
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://acctcdn.msauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://acctcdn.msftauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://acctcdnmsftuswe2.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://acctcdnvzeuno.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://github.com/logi
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://github.com/login/oauth/authorize?response_type=code&client_i
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/login/oauth/authorize?response_type=code&client_id=e37ffdec11c0245cb2e0&scope=rea
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://lgincdnmsftuswe2.azureed
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://lgincdnmsftuswe2.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	String found in binary or memory: https://lgincdnvzeuno.B
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	String found in binary or memory: https://lgincdnvzeuno.BB
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://lgincdnvzeuno.azureedge.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.l
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350759249.0000000000870000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350759249.0000000000870000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/0
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://login.live.com/9
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetCredentialType.s
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetCredentialType.srf?opid=79AE4282C0C1384B&id=250206&uiflavor=w
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetCredentialType.srf?opid=79AE4282C0C1384B&id=250206&uiflavor=web&wa=wsignin
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetSessionState.srf?uiflavor=web&wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/GetSessionState.srf?uiflavor=web&wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7.
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/HandleGithubResponse.srf&allow_signup=false&state=79AE4282C0C1384B
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/Me.htm?v=3&
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/Me.htm?v=3&uaid=dc8fa6b4c18946c2b26a42c526ae2a5f
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/cookiesDisabled.srf?uaid=dc8fa6b4c1
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/cookiesDisabled.srf?uaid=dc8fa6b4c18946c2b26a42c526ae2a5f&mkt=EN-US&lc=1033
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatem
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&uaid=dc8fa6b4c18946c2b26a42c526
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=MSNPrivacyStatement&mkt=EN-US&uaid=dc8fa6b4c18946c2b26a42c526ae
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/gls.srf?urlID=WinLiveTermsOfUse&mkt=EN-US&uaid=dc8fa6b4c18946c2b26a42c526ae2a
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/jsDi
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf%3Fwa%3Dwsignin1.0%26rpsnv%3D13%26ct%3D1632763724%26rver%3D7.3.6962.
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf%3flc%3d1033%26mkt%3dEN-US%26wa%3dwsignin1.0%26rpsnv%3d13%26ct%3d163
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&c
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350759249.0000000000870000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1632763723&rver=7.3.6962.0&wp=MBI_SSL_SHA
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7.3.6962.0&wp=MBI_SS
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.352808466.00000000008B8000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7.3.6962.0&wp=MBI_SSL_SHA
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1632763
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/logout.srf?wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7.3.6962.0&wp=MBI_SSL_SH
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.live.com/ppsecure/post.srf?wa=wsignin1.0&rpsnv=13&ct=1632763724&rver=7.3.6962.0&wp=MBI
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://login.mic
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	String found in binary or memory: https://logincdn.msauth.net
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/Windows_Live_v_thumb.jpg
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/f
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000.29174.3/images/favicon.ico
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wd
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_3ParxANZ-MNmIfU_UoPk
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/Conver
Source: Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353407741.0000000002EE0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358941722.0000000002ED4000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.362316636.000000000262D000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_OjveJe7WDNHIjSCucBEfkA2.js
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.coTR
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/9
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://onedrive.live.com/download%3fcid%3d1B877C3EDE919037%26resid%3d1B877C3EDE919037%2521441%26aut
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=1B877C3EDE919037&resid=1B
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350759249.0000000000870000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358792122.0000000002E7C000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=1B877C3EDE919037&resid=1B877C3EDE919037%21441&authkey=AMAxN3s
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	String found in binary or memory: https://onedrive.live.com/nW
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://onedrive.live.com/preload?view=Folders.All&id=250206&mkt=EN-US
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://p.sfx.ms/login/v1/head
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://p.sfx.ms/login/v1/header.html?id=250206&mkt=EN-US&cbcxt=sky
Source: Auftragsbest#U00e4tigung Dringend.exe	String found in binary or memory: https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/sky/EN-US.html?id=250206&mkt=EN-US&c

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Auftragsbest#U00e4tigung Dringend.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 1968

Source: Auftragsbest#U00e4tigung Dringend.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: Auftragsbest#U00e4tigung Dringend.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Auftragsbest#U00e4tigung Dringend.exe	Virustotal: Detection: 59%
Source: Auftragsbest#U00e4tigung Dringend.exe	Metadefender: Detection: 40%
Source: Auftragsbest#U00e4tigung Dringend.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

File read: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Jump to behavior

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe 'C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe'
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 1968

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6584

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER76A8.tmp

Jump to behavior

Source: classification engine

Classification label: mal64.troj.evad.winEXE@2/4@2/0

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: rsaenh.pdbWQY# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000004.00000003.369075881.00000000046DB000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdbm& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbgQ)#" source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbaQ3#! source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000004.00000003.368777417.000000000056A000.00000004.00000001.sdmp
Source:	Binary string: crypt32.pdbyQK# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb!& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb%Qw# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbc& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: CLBCatQ.pdb?& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: WINMMBASE.pdb{& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: gpapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: dwmapi.pdbS& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb]& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: comctl32v582.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb5& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000004.00000003.368353281.0000000000564000.00000004.00000001.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdbuQG# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb4 source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: ncryptsslp.pdbMQ_# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbO& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbq& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbE& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb; source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb7 source: WerFault.exe, 00000004.00000003.376772929.0000000004C61000.00000004.00000001.sdmp
Source:	Binary string: cryptsp.pdbQQc# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000004.00000003.369145029.000000000055E000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb+& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb'& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: msctf.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbw& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb[Qm# source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: winmm.pdbI& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000004.00000003.368777417.000000000056A000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wininet.pdb& source: WerFault.exe, 00000004.00000003.376887881.0000000004C59000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000004.00000003.376908998.0000000004C81000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000004.00000003.376864157.0000000004C53000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000004.00000003.377218590.0000000004C50000.00000004.00000040.sdmp
Source:	Binary string: OnDemandConnRouteHelper.pdb7 source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000004.00000003.376333435.0000000004C5C000.00000004.00000040.sdmp

Data Obfuscation:

Yara detected DBatLoader

Show sources

Source: Yara match	File source: 00000001.00000000.358219235.0000000002414000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.398644926.0000000002414000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.361969007.0000000002414000.00000004.00000001.sdmp, type: MEMORY

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Unpacked PE file: 1.2.Auftragsbest#U00e4tigung Dringend.exe.400000.0.unpack

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Code function: 1_3_02ED3AB0 push ebx; ret

1_3_02ED3AB1

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp, WerFault.exe, 00000004.00000002.396871243.00000000045E4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW Filter-0000

Source: C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe

Process queried: DebugPort

Jump to behavior

Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358100296.0000000000FA0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358100296.0000000000FA0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358100296.0000000000FA0000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358100296.0000000000FA0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection2	Virtualization/Sandbox Evasion1	Input Capture1	Query Registry1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Non-Application Layer Protocol1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Security Software Discovery11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection2	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Auftragsbest#U00e4tigung Dringend.exe	59%	Virustotal		Browse
Auftragsbest#U00e4tigung Dringend.exe	40%	Metadefender		Browse
Auftragsbest#U00e4tigung Dringend.exe	79%	ReversingLabs	Win32.Trojan.Delf

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
clientconfig.passport.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://lgincdnmsftuswe2.azureed	0%	Avira URL Cloud	safe
https://acctcdn.msftauth.net/	0%	Virustotal		Browse
https://acctcdn.msftauth.net/	0%	Avira URL Cloud	safe
https://login.mic	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_3ParxANZ-MNmIfU_UoPk	0%	Avira URL Cloud	safe
https://acctcdn.msauth.net	0%	URL Reputation	safe
https://logincdn.msauth.net/16.000.29174.3/images/f	0%	Avira URL Cloud	safe
https://account.liv	0%	Avira URL Cloud	safe
https://lgincdnvzeuno.BB	0%	Avira URL Cloud	safe
https://login.l	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000.29174.3/images/favicon.ico	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/	0%	URL Reputation	safe
https://acctcdn.msauth.net/	0%	URL Reputation	safe
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wd	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/16.000.29174.3/images/Windows_Live_v_thumb.jpg	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/content/js/Conver	0%	Avira URL Cloud	safe
https://lgincdnvzeuno.B	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_OjveJe7WDNHIjSCucBEfkA2.js	0%	Avira URL Cloud	safe
https://logincdn.msauth.net	0%	URL Reputation	safe
https://onedrive.live.coTR	0%	Avira URL Cloud	safe
https://logincdn.msauth.net/shared/1.0/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
onedrive.live.com	unknown	unknown	false		high
clientconfig.passport.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://lgincdnmsftuswe2.azureed	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://acctcdn.msftauth.net/	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.mic	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wdR-g2.css	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en_3ParxANZ-MNmIfU_UoPk	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://acctcdn.msauth.net	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://logincdn.msauth.net/16.000.29174.3/images/f	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://account.liv	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/download?cid=1B877C3EDE919037&resid=1B877C3EDE919037%21441&authkey=AMAxN3s	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.350759249.0000000000870000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358792122.0000000002E7C000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	false		high
https://lgincdnvzeuno.BB	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://login.l	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://logincdn.msauth.net/16.000.29174.3/images/favicon.ico	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://p.sfx.ms/login/v1/header.html?id=250206&mkt=EN-US&cbcxt=sky	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://onedrive.live.com/	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	false		high
https://onedrive.live.com/download%3fcid%3d1B877C3EDE919037%26resid%3d1B877C3EDE919037%2521441%26aut	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://sc.imp.live.com/content/dam/imp/surfaces/mail_signin/v3/sky/EN-US.html?id=250206&mkt=EN-US&c	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://logincdn.msauth.net/	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/security/LoginStage.aspx?lmif=1000&ru	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://acctcdn.msauth.net/	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://github.com/login/oauth/authorize?response_type=code&client_i	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://github.com/login/oauth/authorize?response_type=code&client_id=e37ffdec11c0245cb2e0&scope=rea	Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	false		high
https://logincdn.msauth.net/16.000/Converged_v21033__M8MTZS7Nv0I1zR18wd	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/preload?view=Folders.All&id=250206&mkt=EN-US	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://p.sfx.ms/login/v1/head	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://logincdn.msauth.net/16.000.29174.3/images/Windows_Live_v_thumb.jpg	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://logincdn.msauth.net/shared/1.0/content/js/Conver	Auftragsbest#U00e4tigung Dringend.exe	false	Avira URL Cloud: safe	unknown
https://account.live.com/username/recover?wreply=https://login.live.c	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://lgincdnvzeuno.B	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/download?cid=1B877C3EDE919037&resid=1B	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	false		high
https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_OjveJe7WDNHIjSCucBEfkA2.js	Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353407741.0000000002EE0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.358941722.0000000002ED4000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.362316636.000000000262D000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353390647.0000000002ED0000.00000004.00000001.sdmp, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://logincdn.msauth.net	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398133887.000000000086B000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://onedrive.live.com/9	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000000.357731768.00000000007FA000.00000004.00000020.sdmp	false		high
https://onedrive.live.coTR	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://onedrive.live.com/nW	Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000002.398112791.0000000000853000.00000004.00000020.sdmp	false		high
https://github.com/logi	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://logincdn.msauth.net/shared/1.0/	Auftragsbest#U00e4tigung Dringend.exe, Auftragsbest#U00e4tigung Dringend.exe, 00000001.00000003.353369894.00000000008B1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/ChangePassword?uaid=dc8fa6b4c18946c2b26a42c526ae2a5f	Auftragsbest#U00e4tigung Dringend.exe	false		high
https://account.live.com/query.aspx?uaid=dc8fa6b4c18946c2b26a42c526ae2a5f&mkt=EN-US&lc=1033&id=25020	Auftragsbest#U00e4tigung Dringend.exe	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491651
Start date:	27.09.2021
Start time:	19:27:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Auftragsbest#U00e4tigung Dringend.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.troj.evad.winEXE@2/4@2/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.89.38.104, 23.210.182.5, 20.82.210.154, 204.79.197.200, 13.107.21.200, 13.107.42.13, 20.190.160.75, 20.190.160.132, 20.190.160.6, 20.190.160.8, 20.190.160.73, 20.190.160.67, 20.190.160.2, 20.190.160.4, 23.54.113.53, 13.89.179.12, 20.54.110.249, 40.112.88.60, 20.82.209.183, 23.10.249.43, 23.10.249.26, 95.100.54.203 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, onedsblobprdcus17.centralus.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, e13551.dscg.akamaiedge.net, l-0004.l-msedge.net, msagfx.live.com-6.edgekey.net, e12564.dspb.akamaiedge.net, authgfx.msa.akadns6.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, login.live.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, odc-web-geo.onedrive.akadns.net, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, www.tm.a.prd.aadg.akadns.net, login.msa.msidentity.com, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:28:41	API Interceptor	1x Sleep call for process: Auftragsbest#U00e4tigung Dringend.exe modified
19:29:03	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Auftragsbest#U00_e3b95c6b267aed71e39879d4727ca63bf4c9e8_fd6e1fa4_1b86a4fb\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	14064
Entropy (8bit):	3.767654774062426
Encrypted:	false
SSDEEP:	192:6etOZmDHnmHBUZMXyB/jrhk8Zd/u7sMS274ItX8Z9:pfreBUZMXojrd/u7sMX4Itg9
MD5:	A9DD6FB10E8A1B2645D66656251B6973
SHA1:	FFD66819B8F28462B080355C410E6DF3A9275EB1
SHA-256:	BDF0D2A0BA22A2CF7F564B89E31BF2516856AEF611B8D4316E26AE515CA3251A
SHA-512:	82D2C3038E3A85FF8FF2C2F3A509F5B5CDA63D6CBAF52A622A86DA288FBA923D4705CC6E9777422C10FADE2E85E94F003545F137C98C46BEF50C6CA2AB7D65DF
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.7.7.2.6.9.7.3.1.6.4.6.3.6.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.7.7.2.6.9.7.4.1.9.9.6.2.0.3.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.3.9.3.3.8.b.a.-.9.0.d.3.-.4.f.2.8.-.8.f.4.b.-.c.4.b.8.8.4.5.1.d.b.1.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.8.4.c.7.5.c.-.b.1.2.c.-.4.6.2.f.-.8.e.4.0.-.2.b.b.d.8.c.5.9.8.3.7.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.u.f.t.r.a.g.s.b.e.s.t.#.U.0.0.e.4.t.i.g.u.n.g. . .D.r.i.n.g.e.n.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.8.-.0.0.0.1.-.0.0.1.7.-.0.1.9.a.-.9.c.8.c.1.0.b.4.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.7.5.8.1.f.c.e.c.9.6.c.4.f.a.6.5.7.4.b.d.7.5.3.e.c.0.d.c.3.a.0.0.0.0.0.f.f.f.f.!.0.0.0.0.0.b.a.8.d.a.5.d.5.1.a.7.7.7.9.8.0.1.0.e.6.b.1.a.2.a.8.e.7.5.9.c.8.b.c.b.e.7.f.a.!.A.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER76A8.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Sep 28 02:28:54 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	122024
Entropy (8bit):	2.019226623063448
Encrypted:	false
SSDEEP:	384:QId43d2u9Y2A9DCSWxLQEV8qMtD148k6emGJUFWzBqn7S5MKUpuSN2c/d:a3dvi2A9eSWVQEV8qMtD1bYCOGVKApNh
MD5:	BE5DC4C8BED8089A77BAD3319FCA90CD
SHA1:	A29FCF7B28153394A7FF563C96E758B4D00F6907
SHA-256:	53FFE8158802F96B74B5DD6974F0A0363E5980B2C4C2745E664A3F96EAB484C6
SHA-512:	CF1E75D832E857838BD2730DD3A456A329BA1716374F005D11ACEE0E18FFCB9702C2F6664D3CC6D7ED9B7C73B1028077C42AEFD311269DA1E9E8831B35D91667
Malicious:	false
Reputation:	low
Preview:	MDMP....... ........}Ra...................U...........B......p'......GenuineIntelW...........T............}Ra.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83F7.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8454
Entropy (8bit):	3.7055577938875466
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiQ6X6IhSE6YJ7SUU1Ip9mgmfUbS0rCprx89bItsfRFYm:RrlsNiH6IhJ6YlSUU1IqgmfwS0dImf5
MD5:	CD37FC88E8C40A20E4071DCB65297A2C
SHA1:	BDB3CFA8B8DAFC17BAEA3E914EF25CB95AB188B3
SHA-256:	4903CCCF34E2FEC7C58A196D2B1BB41E13391A67F8F62233490927705B3D5628
SHA-512:	D89112998C191826401319C4E9E2463942F7B317653F3BCA9753F3C29D62948B7F24E61F108C19F63F1313DF1FDFEFCA75812ED6C6161075C05FA9AC8F850076
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.8.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8FDF.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4723
Entropy (8bit):	4.5260388795915745
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9TMSWSC8Bj8fm8M4JpAJEZFmo+q821UBTuuZuWd:uITfJkMzSNaJpA2qoZeBTuuZuWd
MD5:	D66B381C132AF1BB55E33CFE82CC3BA0
SHA1:	CB5A8ADFF3F726B42463E0D413AE2BCBBF761267
SHA-256:	47789E0E275A26A926365A0C811912D5859F676E0804E97C878BA0F4425E4412
SHA-512:	D6B4BA38EC4D155CD79C09E03B67F4D57A1D8A44BACE81A10DB5CAC50ED61A65DC67BD815AD9F65453C0CB70FED606C57D3E8850D2764F94A4DD7FE1C5B4849A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1185819" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.785741094468421
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Auftragsbest#U00e4tigung Dringend.exe
File size:	831488
MD5:	b8d99b6c405fc56bd8a1448421d64eac
SHA1:	0ba8da5d51a77798010e6b1a2a8e759c8bcbe7fa
SHA256:	e2bf9e2c787866d86fc1ae939c378f7d22fab268a00ae163fff1b79332df2088
SHA512:	5b1408332ce31003708a5de87bb2b7e3df4731d1d978a3f9dab992a12ccea57ab04239955fd3a56af867fd160ede3d3830826231352bacd0416f887e4e3c070f
SSDEEP:	24576:DMvnUyU3fec2QPesTHGIZHrIzvlZwXI7Dyj3SaH+MJF:DqUjes
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0a121272a98ce659

Static PE Info

General
Entrypoint:	0x4668bc
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ff0bb68e944131943365efbe4d5b9737

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 004651B8h
call 00007F924CA65ED9h
mov eax, dword ptr [00468C18h]
mov eax, dword ptr [eax]
call 00007F924CABC689h
mov ecx, dword ptr [00468D1Ch]
mov eax, dword ptr [00468C18h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00464E40h]
call 00007F924CABC689h
mov eax, dword ptr [00468C18h]
mov eax, dword ptr [eax]
call 00007F924CABC6FDh
call 00007F924CA63C74h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6d000	0x2574	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x79000	0x5a800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0x6eb4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x71000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6d6f4	0x5dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x643c0	0x64400	False	0.526362316864	data	6.54514333706	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.itext	0x66000	0x904	0xa00	False	0.573046875	data	5.83221478683	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x67000	0x1dbc	0x1e00	False	0.413802083333	data	3.99870200843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bss	0x69000	0x388c	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x6d000	0x2574	0x2600	False	0.320106907895	data	5.16694007124	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x70000	0x34	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x71000	0x18	0x200	False	0.05078125	data	0.170145652003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0x6eb4	0x7000	False	0.624337332589	data	6.67037544234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x79000	0x5a800	0x5a800	False	0.245144164365	data	5.96186308461	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
DONGA	0x79b9c	0x4cae4	PC bitmap, Windows 3.x format, 319 x 158 x 4	English	United States
RT_CURSOR	0xc6680	0x134	data	English	United States
RT_CURSOR	0xc67b4	0x134	data	English	United States
RT_CURSOR	0xc68e8	0x134	data	English	United States
RT_CURSOR	0xc6a1c	0x134	data	English	United States
RT_CURSOR	0xc6b50	0x134	data	English	United States
RT_CURSOR	0xc6c84	0x134	data	English	United States
RT_CURSOR	0xc6db8	0x134	data	English	United States
RT_BITMAP	0xc6eec	0x1d0	data	English	United States
RT_BITMAP	0xc70bc	0x1e4	data	English	United States
RT_BITMAP	0xc72a0	0x1d0	data	English	United States
RT_BITMAP	0xc7470	0x1d0	data	English	United States
RT_BITMAP	0xc7640	0x1d0	data	English	United States
RT_BITMAP	0xc7810	0x1d0	data	English	United States
RT_BITMAP	0xc79e0	0x1d0	data	English	United States
RT_BITMAP	0xc7bb0	0x1d0	data	English	United States
RT_BITMAP	0xc7d80	0x1d0	data	English	United States
RT_BITMAP	0xc7f50	0x1d0	data	English	United States
RT_BITMAP	0xc8120	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xc8208	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xc8670	0x988	data	English	United States
RT_ICON	0xc8ff8	0x10a8	data	English	United States
RT_ICON	0xca0a0	0x25a8	data	English	United States
RT_ICON	0xcc648	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 0, next used block 0	English	United States
RT_DIALOG	0xd0870	0x52	data
RT_DIALOG	0xd08c4	0x52	data
RT_STRING	0xd0918	0x33c	data
RT_STRING	0xd0c54	0x2b4	data
RT_STRING	0xd0f08	0xc8	data
RT_STRING	0xd0fd0	0xec	data
RT_STRING	0xd10bc	0x378	data
RT_STRING	0xd1434	0x40c	data
RT_STRING	0xd1840	0x394	data
RT_STRING	0xd1bd4	0x400	data
RT_STRING	0xd1fd4	0x190	data
RT_STRING	0xd2164	0xcc	data
RT_STRING	0xd2230	0x1c4	data
RT_STRING	0xd23f4	0x3c8	data
RT_STRING	0xd27bc	0x338	data
RT_STRING	0xd2af4	0x294	data
RT_RCDATA	0xd2d88	0x10	data
RT_RCDATA	0xd2d98	0x2b0	data
RT_RCDATA	0xd3048	0x692	Delphi compiled form 'TForm1'
RT_GROUP_CURSOR	0xd36dc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd36f0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3704	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3718	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd372c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3740	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0xd3754	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0xd3768	0x4c	data	English	United States

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcmpiA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 19:28:34.996521950 CEST	49283	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:35.019392014 CEST	53	49283	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:35.151721954 CEST	58377	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:35.202702999 CEST	53	58377	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:37.357155085 CEST	55074	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:37.384210110 CEST	53	55074	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:37.486279964 CEST	54513	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:37.521462917 CEST	53	54513	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:42.812701941 CEST	62044	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:42.882693052 CEST	53	62044	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:43.692917109 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:43.727102995 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 27, 2021 19:28:44.261135101 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:28:44.283272028 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:03.658433914 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:03.672521114 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:12.378494978 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:12.391988993 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:32.863498926 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:32.935523033 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:34.018455029 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:34.096426964 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:35.374353886 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:35.389261961 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:35.424005032 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:35.453103065 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:36.941054106 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:37.032180071 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:37.565927029 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:37.584573030 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:38.041116953 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:38.055824041 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:38.540839911 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:38.553453922 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:40.009978056 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:40.023839951 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:40.922318935 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:40.935946941 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:42.259274006 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:42.272805929 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:47.276354074 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:47.294871092 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:47.305773020 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:47.308984041 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 19:29:50.223664045 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:29:50.241420031 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 19:30:03.502738953 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:30:03.546329975 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 19:30:25.268376112 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:30:25.281563044 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 27, 2021 19:30:26.290090084 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 27, 2021 19:30:26.303219080 CEST	53	49694	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 27, 2021 19:28:35.151721954 CEST	192.168.2.6	8.8.8.8	0x2e0b	Standard query (0)	clientconfig.passport.net	A (IP address)	IN (0x0001)
Sep 27, 2021 19:28:42.812701941 CEST	192.168.2.6	8.8.8.8	0x2e23	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class
Sep 27, 2021 19:28:35.202702999 CEST	8.8.8.8	192.168.2.6	0x2e0b	No error (0)	clientconfig.passport.net	authgfx.msa.akadns6.net	CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 19:28:42.882693052 CEST	8.8.8.8	192.168.2.6	0x2e23	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net	CNAME (Canonical name)	IN (0x0001)
Sep 27, 2021 19:28:43.727102995 CEST	8.8.8.8	192.168.2.6	0x6ca	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net	CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Auftragsbest#U00e4tigung Dringend.exe PID: 6584 Parent PID: 5176

General

Start time:	19:28:40
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Auftragsbest#U00e4tigung Dringend.exe'
Imagebase:	0x400000
File size:	831488 bytes
MD5 hash:	B8D99B6C405FC56BD8A1448421D64EAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000000.358219235.0000000002414000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000002.398644926.0000000002414000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000000.361969007.0000000002414000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 7008 Parent PID: 6584

General

Start time:	19:28:48
Start date:	27/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 1968
Imagebase:	0x1160000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Auftragsbest#U00e4tigung Dringend.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Auftragsbest#U00e4tigung Dringend.exe PID: 6584 Parent PID: 5176

General

Chronological Activities