Windows Analysis Report Specification.doc

Overview

General Information

Sample Name:	Specification.doc
Analysis ID:	502702
MD5:	a9c264b36e9a8bcb07dd7caad3e74c7a
SHA1:	b123be7f202496264a25ea58d9b6116eba3de5da
SHA256:	a386ffc6861f5ddad443d3b4d98d91a0bed209b7662e24fbc0bb2478a417d177
Tags:	doc
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Sigma detected: EQNEDT32.EXE connecting to internet

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: File Dropped By EQNEDT32EXE

Installs a global keyboard hook

Tries to harvest and steal ftp login credentials

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Office equation editor drops PE file

.NET source code contains very large array initializations

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to steal Mail credentials (via file access)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Potential document exploit detected (performs DNS queries)

IP address seen in connection with other malware

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Potential document exploit detected (unknown TCP traffic)

PE file contains strange resources

Adds / modifies Windows certificates

Drops PE files

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Office Equation Editor has been started

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection:

Found malware configuration

Source: 11.2.newapp.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "yashanka.patabandige@dlmahtea.co", "Password": "FocusYourSEF@123", "Host": "mail.privateemail.com"}

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe			Jump to behavior

Office Equation Editor has been started

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Window created: window name: CLIPBRDWNDCLASS

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\booobb[1].exe			Jump to dropped file

Source: 7.2.edufyrigefy4utwgqeoriufj4ce.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b2F86C81Eu002d9255u002d4FC5u002dA8A7u002d333F43D4D423u007d/u0036ABE793Fu002d8399u002d42DCu002dADDBu002d204C80BA7E0A.cs	Large array initialization: .cctor: array initializer size 11951
Source: 11.2.newapp.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b2F86C81Eu002d9255u002d4FC5u002dA8A7u002d333F43D4D423u007d/u0036ABE793Fu002d8399u002d42DCu002dADDBu002d204C80BA7E0A.cs	Large array initialization: .cctor: array initializer size 11951

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_003201B4	4_2_003201B4
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_003279B8	4_2_003279B8
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_003279C8	4_2_003279C8
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_00322792	4_2_00322792
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_00320790	4_2_00320790
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00226060	7_2_00226060
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00225448	7_2_00225448
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_0022D710	7_2_0022D710
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00225790	7_2_00225790
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_0022DE70	7_2_0022DE70
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_0022219F	7_2_0022219F
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F8BAC8	7_2_00F8BAC8
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F83EB8	7_2_00F83EB8
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F85E88	7_2_00F85E88
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F891B0	7_2_00F891B0
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F80048	7_2_00F80048
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F84DB0	7_2_00F84DB0
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F8B588	7_2_00F8B588
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_04A70048	7_2_04A70048
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_04A73348	7_2_04A73348
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 8_2_001D01B4	8_2_001D01B4
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 8_2_001D79B8	8_2_001D79B8
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 8_2_001D79C8	8_2_001D79C8
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 8_2_001D0790	8_2_001D0790
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 8_2_001D1792	8_2_001D1792
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 11_2_00266060	11_2_00266060
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 11_2_00265448	11_2_00265448
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 11_2_0026219F	11_2_0026219F
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 11_2_00265790	11_2_00265790
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A01B4	12_2_001A01B4
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A79B8	12_2_001A79B8
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A79C8	12_2_001A79C8
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A7AA8	12_2_001A7AA8
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A1492	12_2_001A1492
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 12_2_001A0790	12_2_001A0790
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 17_2_00226060	17_2_00226060
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 17_2_00225448	17_2_00225448
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 17_2_00225790	17_2_00225790
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 17_2_0022219F	17_2_0022219F

Source: edufyrigefy4utwgqeoriufj4ce.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: booobb[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: yxnDFepLbf.exe.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: newapp.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76F90000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory allocated: 76E90000 page execute and read and write

Source: edufyrigefy4utwgqeoriufj4ce.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: booobb[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: yxnDFepLbf.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: newapp.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................'.........E.R.R.O.R.:. ...................$.................................................-.......................'.....	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................'.........E.R.R.O.(.P.....................$.......................................................X.................'.....	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.R.:. ...........................7.........................................".............................	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................................E.R.R.O.(.P.............................=...............................................X.......................	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................(.........E.R.R.O.R.:. ...................X.........................................................................(.....
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ......................(.........E.R.R.O.(.P.....................X.......................................................X.................(.....

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmp7B0A.tmp'
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe 'C:\Users\user\AppData\Roaming\newapp\newapp.exe'
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmpEC63.tmp'
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe 'C:\Users\user\AppData\Roaming\newapp\newapp.exe'
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmp10D3.tmp'
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmp7B0A.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process created: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmpEC63.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\yxnDFepLbf' /XML 'C:\Users\user\AppData\Local\Temp\tmp10D3.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process created: C:\Users\user\AppData\Roaming\newapp\newapp.exe C:\Users\user\AppData\Roaming\newapp\newapp.exe	Jump to behavior

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.664596383.0000000002431000.00000004.00000001.sdmp, newapp.exe, 0000000B.00000002.506916531.0000000002261000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: newapp.exe, 0000000B.00000002.506916531.0000000002261000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: newapp.exe, 0000000B.00000002.506916531.0000000002261000.00000004.00000001.sdmp	String found in binary or memory: http://Nbucou.com
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515981287.0000000008852000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0=
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515981287.0000000008852000.00000004.00000001.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515921788.00000000060CE000.00000004.00000001.sdmp	String found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515898451.00000000060F0000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/seccli/repository/CRL.der0J
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515994593.0000000006113000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/secsrv/repository/CRL.der1
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515994593.0000000006113000.00000004.00000001.sdmp	String found in binary or memory: http://ca.sia.it/secsrv/repository/CRL.der11
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515921788.00000000060CE000.00000004.00000001.sdmp	String found in binary or memory: http://certificates.starfieldtech.com/repository/1604
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515981287.0000000008852000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/publicnotaryroot.html0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515981287.0000000008852000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/publicnotaryroot.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.645559784.00000000060F0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.644743340.0000000008850000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515921788.00000000060CE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.516069331.000000000884C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515921788.00000000060CE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515965439.0000000008848000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ssc.lt/root-b/cacrl.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.505169057.00000000060EF000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.co
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.665038465.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.645695967.00000000005A5000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515921788.00000000060CE000.00000004.00000001.sdmp, edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.505245755.00000000060E3000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.668190347.0000000006030000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabgB
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignAdvancedSecurityCA.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515808127.00000000060B4000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000003.515981287.0000000008852000.00000004.00000001.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Source: 7.2.edufyrigefy4utwgqeoriufj4ce.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.2.edufyrigefy4utwgqeoriufj4ce.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.newapp.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.newapp.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: edufyrigefy4utwgqeoriufj4ce.exe.2.dr, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: booobb[1].exe.2.dr, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: yxnDFepLbf.exe.4.dr, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.edufyrigefy4utwgqeoriufj4ce.exe.f90000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.f90000.1.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: newapp.exe.7.dr, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 7.2.edufyrigefy4utwgqeoriufj4ce.exe.f90000.1.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 7.0.edufyrigefy4utwgqeoriufj4ce.exe.f90000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 8.2.newapp.exe.cc0000.1.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 8.0.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.2.newapp.exe.cc0000.1.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.2.newapp.exe.cc0000.1.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 12.0.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.0.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.2.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.2.newapp.exe.cc0000.0.unpack, MainForm.cs	.Net Code: Marshaler System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_00C414BF push es; retn 0000h	4_2_00C414C2
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_00C41469 push es; retn 0000h	4_2_00C4146A
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 4_2_00C41429 push es; retn 0000h	4_2_00C4142A
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00221BE3 push ebx; iretd	7_2_00221C52
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F81AA2 pushfd ; retn 001Ch	7_2_00F81B89
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Code function: 7_2_00F81A50 push esp; retn 001Ch	7_2_00F81A51
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 11_2_00261BE3 push ebx; iretd	11_2_00261C52
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Code function: 17_2_00221C13 push ebx; iretd	17_2_00221C52

Source: initial sample	Static PE information: section name: .text entropy: 7.77653013154
Source: initial sample	Static PE information: section name: .text entropy: 7.77653013154
Source: initial sample	Static PE information: section name: .text entropy: 7.77653013154
Source: initial sample	Static PE information: section name: .text entropy: 7.77653013154

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run newapp			Jump to behavior

Source: Yara match	File source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.243d308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.newapp.exe.22cd29c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.newapp.exe.216d29c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.505779927.0000000002161000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.413432114.0000000002431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: edufyrigefy4utwgqeoriufj4ce.exe PID: 1184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newapp.exe PID: 2852, type: MEMORYSTR

Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000004.00000002.413432114.0000000002431000.00000004.00000001.sdmp, newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000004.00000002.413432114.0000000002431000.00000004.00000001.sdmp, newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2636	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2640	Thread sleep time: -37852s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2640	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2044	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2600	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe TID: 2600	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2524	Thread sleep time: -34373s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2524	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2420	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2588	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2588	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 1848	Thread sleep count: 553 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 1848	Thread sleep count: 3560 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2588	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 1704	Thread sleep time: -35914s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 1704	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2644	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2540	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2168	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2168	Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2840	Thread sleep count: 9574 > 30
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2840	Thread sleep count: 162 > 30
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe TID: 2168	Thread sleep count: 106 > 30

Windows Analysis Report Specification.doc

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Window / User API: threadDelayed 9680	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Window / User API: threadDelayed 553	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Window / User API: threadDelayed 3560	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Window / User API: threadDelayed 9574

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 37852	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 34373	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 35914	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Thread delayed: delay time: 30000

Source: newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: newapp.exe, 00000008.00000002.484160274.00000000056B0000.00000004.00000001.sdmp	Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: newapp.exe, 00000008.00000002.483272364.00000000022C1000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Memory written: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory written: C:\Users\user\AppData\Roaming\newapp\newapp.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Memory written: C:\Users\user\AppData\Roaming\newapp\newapp.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.664498063.0000000001030000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.664498063.0000000001030000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: edufyrigefy4utwgqeoriufj4ce.exe, 00000007.00000002.664498063.0000000001030000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Queries volume information: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Queries volume information: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Users\user\AppData\Roaming\newapp\newapp.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\newapp\newapp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation

Source: Yara match	File source: 11.2.newapp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.newapp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edufyrigefy4utwgqeoriufj4ce.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.newapp.exe.35699f0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.36d99f0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.newapp.exe.34099f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.newapp.exe.330fd40.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.newapp.exe.35699f0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.3588720.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.36d99f0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.newapp.exe.346fd40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.newapp.exe.34099f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.edufyrigefy4utwgqeoriufj4ce.exe.35dfd40.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.newapp.exe.3418720.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.newapp.exe.32b8720.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.663485397.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.663533545.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.483735795.00000000035BF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.414520303.000000000372F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.505958916.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.507386874.000000000345F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.483487835.00000000032C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.506532288.0000000003169000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.413796340.0000000003439000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.664596383.0000000002431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.665038465.00000000024F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.506916531.0000000002261000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.666161805.000000000280A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.664255420.0000000002161000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: edufyrigefy4utwgqeoriufj4ce.exe PID: 1184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: edufyrigefy4utwgqeoriufj4ce.exe PID: 2820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newapp.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: newapp.exe PID: 2924, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edufyrigefy4utwgqeoriufj4ce.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior