Source: 00000000.00000002.558633327.0000000002130000.00000040.00000001.sdmp |
Malware Configuration Extractor: Ursnif {"RSA Public Key": "dm+RfNkITE5FceWriGPYkZaFfoP/k2XQ2jeLd8rNgFw6gJ6fNWsHd0U6akxsQHth/SBWm4/eMI9Y1qgwNJteasgQsUC7Ht20y96mIxH1hvPh9uvLSH5z2CNo+fcP8K+V0yoOOQzDln/qE7mMJHLu+rmogHE7S6lb7FVy/7xxrRe3zMDt5K9bDwOreWw0blGE", "c2_domain": ["yahoo.com", "soderunovos.website", "qoderunovos.website", "https://soderunovos.website", "https://qoderunovos.website"], "botnet": "4482", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "dga_base_url": "constitution.org/usdeclar.txt", "dga_tld": "com ru org", "DGA_count": "10"} |
Source: R0xLHA2mT5.exe, 00000000.00000003.448860394.000000000242A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559628202.000000000242D000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354035535.00000000023E6000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354962867.000000000242B000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354031046.00000000023E2000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354046152.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: *.www.yahoo.com equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448860394.000000000242A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559628202.000000000242D000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354035535.00000000023E6000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559383521.00000000023C6000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354962867.000000000242B000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354031046.00000000023E2000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354046152.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: *.www.yahoo.com0 equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp |
String found in binary or memory: +www.yahoo.com; equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.355137973.000000000477B000.00000004.00000040.sdmp |
String found in binary or memory: <noscript><META http-equiv="refresh" content="0;URL='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fbxL1xwjyIDF%2fWhnrXJWmz2Twl8%2fgY8V0mj8FFAgQDgBa_2Fr%2fju3YDzGHJQvJy7Ul%2fWNFipJkcZdncwpj%2fywnxu6MUxONK0Xvi9f%2fucETuIFdm%2fwokZPT9eFRDqyFNdNZik%2fFUVXSPqAP_2FwjH1nuX%2f3xMD5fDEH8K9cekhYWTKgU%2flNhM0C6AYaGMU%2fwTNgbH70ZfWGyVix%2f60.crw'"></noscript> equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354046152.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: Location: https://www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZdncwpj/ywnxu6MUxONK0Xvi9f/ucETuIFdm/wokZPT9eFRDqyFNdNZik/FUVXSPqAP_2FwjH1nuX/3xMD5fDEH8K9cekhYWTKgU/lNhM0C6AYaGMU/wTNgbH70ZfWGyVix/60.crw equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: MUxOnew-fp-shed.wg1.b.yahoo.comwww.yahoo.comVXSPqAP_2FwjH1nuX/3xMD5fDEH8K9cekhYWTK equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: com.yahoo.www. equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/ equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/6 equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/? equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/\en-US\CRYPT32.dll.muiq equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZdncwpj/ywnxu6MUxONK0Xvi9f/ucETuIFdm/wokZPT9eFRDqyFNdNZik/FUVXSPqAP_2FwjH1nuX/3xMD5fDEH8K9cekhYWTKgU/lNhM0C6AYaGMU/wTNgbH70ZfWGyVix/60.crw equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: s://www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZdncwpj/ywnxu6MUxONK0Xvi9f/ucETuIFdm/wokZPT9eFRDqyFNdNZik/FUVXSPqAP_2FwjH1nuX/3xMD5fDEH8K9cekhYWTKgU/lNhM0C6AYaGMU/wTNgbH70ZfWGyVix/60.crw equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fbxL1xwjyIDF%2fWhnrXJWmz2Twl8%2fgY8V0mj8FFAgQDgBa_2Fr%2fju3YDzGHJQvJy7Ul%2fWNFipJkcZdncwpj%2fywnxu6MUxONK0Xvi9f%2fucETuIFdm%2fwokZPT9eFRDqyFNdNZik%2fFUVXSPqAP_2FwjH1nuX%2f3xMD5fDEH8K9cekhYWTKgU%2flNhM0C6AYaGMU%2fwTNgbH70ZfWGyVix%2f60.crw'; equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559383521.00000000023C6000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.560060461.0000000004FDA000.00000004.00000010.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com- equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZd equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZdncwpj/ywnxu6MUxONK0Xvi9f/ucETuIFdm/wokZPT9eFRDqyFNdNZik/FUVXSPqAP_2FwjH1nuX/3xMD5fDEH8K9cekhYWTKgU/lNhM0C6AYaGMU/wTNgbH70ZfWGyVix/60.crw equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com5 equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559383521.00000000023C6000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.com>Y equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.comG equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: www.yahoo.comows\system32\jsproxy.dll equals www.yahoo.com (Yahoo) |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354035535.00000000023E6000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 |
Source: R0xLHA2mT5.exe, 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000003.355137973.000000000477B000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage®ion=US&lang=en-US&device=desktop&yrid=0p1 |
Source: R0xLHA2mT5.exe, 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000003.355137973.000000000477B000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml |
Source: R0xLHA2mT5.exe, 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp |
String found in binary or memory: https://qoderunovos.website |
Source: R0xLHA2mT5.exe, 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp |
String found in binary or memory: https://soderunovos.website |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/ |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/0 |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/T |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/_ |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/jdraw/Few7Dvcu/4Rmd9fKY9IL2UtEgJUD5q9n/BajREx_2Bc/Peb7n8IHTpfTu9y6I/faIv |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://soderunovos.website/s |
Source: R0xLHA2mT5.exe, 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp |
String found in binary or memory: https://soderunovos.websitehttps://qoderunovos.website |
Source: R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/ |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/6 |
Source: R0xLHA2mT5.exe, 00000000.00000003.448832665.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559469390.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/? |
Source: R0xLHA2mT5.exe, 00000000.00000003.355137973.000000000477B000.00000004.00000040.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354933028.00000000023FB000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fbxL1xwjyIDF%2fWhnrXJWmz |
Source: R0xLHA2mT5.exe, 00000000.00000002.559418267.00000000023E0000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.448819097.00000000023DD000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354046152.00000000023FB000.00000004.00000001.sdmp, R0xLHA2mT5.exe, 00000000.00000003.354919579.00000000023E0000.00000004.00000001.sdmp |
String found in binary or memory: https://www.yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJ |
Source: R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp |
String found in binary or memory: https://yahoo.com/b |
Source: R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp |
String found in binary or memory: https://yahoo.com/d |
Source: R0xLHA2mT5.exe, 00000000.00000002.559183663.000000000236A000.00000004.00000001.sdmp |
String found in binary or memory: https://yahoo.com/jdraw/bxL1xwjyIDF/WhnrXJWmz2Twl8/gY8V0mj8FFAgQDgBa_2Fr/ju3YDzGHJQvJy7Ul/WNFipJkcZd |
Source: Yara match |
File source: 00000000.00000003.354992227.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355061879.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355079733.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355113871.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355042494.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355017568.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355125356.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: R0xLHA2mT5.exe PID: 3608, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.22b0000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.559974818.00000000042A9000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.354992227.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355061879.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355079733.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355113871.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355042494.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355017568.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355125356.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: R0xLHA2mT5.exe PID: 3608, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.22b0000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.559974818.00000000042A9000.00000004.00000040.sdmp, type: MEMORY |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_00401703 NtMapViewOfSection, |
0_2_00401703 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_00401C90 GetProcAddress,NtCreateSection,memset, |
0_2_00401C90 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_004019A0 NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, |
0_2_004019A0 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022B9A0F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, |
0_2_022B9A0F |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022BB1E5 NtQueryVirtualMemory, |
0_2_022BB1E5 |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG |
Source: R0xLHA2mT5.exe |
Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022BE62F push edi; retf |
0_2_022BE630 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022BAC00 push ecx; ret |
0_2_022BAC09 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022BAFAF push ecx; ret |
0_2_022BAFBF |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_022BE9AC push 0B565A71h; ret |
0_2_022BE9B1 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_0042E630 push ecx; mov dword ptr [esp], 00000000h |
0_2_0042E631 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_023600A6 push esp; iretd |
0_2_023600B7 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_02363EAD push 12BFE4EFh; ret |
0_2_02363EB2 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_0235EE91 push edx; iretd |
0_2_0235EEC8 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_0235E89D push esi; iretd |
0_2_0235E89E |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_02362CF3 push es; iretd |
0_2_02362CF6 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_0235F184 push ebx; retf |
0_2_0235F196 |
Source: C:\Users\user\Desktop\R0xLHA2mT5.exe |
Code function: 0_2_02365B88 push ds; ret |
0_2_02365B89 |
Source: Yara match |
File source: 00000000.00000003.354992227.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355061879.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355079733.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355113871.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355042494.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355017568.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355125356.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: R0xLHA2mT5.exe PID: 3608, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.22b0000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.559974818.00000000042A9000.00000004.00000040.sdmp, type: MEMORY |
Source: R0xLHA2mT5.exe, 00000000.00000002.559717345.00000000028D0000.00000002.00020000.sdmp |
Binary or memory string: Program Manager |
Source: R0xLHA2mT5.exe, 00000000.00000002.559717345.00000000028D0000.00000002.00020000.sdmp |
Binary or memory string: Shell_TrayWnd |
Source: R0xLHA2mT5.exe, 00000000.00000002.559717345.00000000028D0000.00000002.00020000.sdmp |
Binary or memory string: Progman |
Source: R0xLHA2mT5.exe, 00000000.00000002.559717345.00000000028D0000.00000002.00020000.sdmp |
Binary or memory string: Progmanlock |
Source: Yara match |
File source: 00000000.00000003.354992227.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355061879.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355079733.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355113871.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355042494.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355017568.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355125356.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: R0xLHA2mT5.exe PID: 3608, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.22b0000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.559974818.00000000042A9000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.354992227.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355061879.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355102011.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000002.560013904.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355079733.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355113871.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355042494.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355017568.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: 00000000.00000003.355125356.0000000004778000.00000004.00000040.sdmp, type: MEMORY |
Source: Yara match |
File source: Process Memory Space: R0xLHA2mT5.exe PID: 3608, type: MEMORYSTR |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.raw.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.22b0000.2.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 0.2.R0xLHA2mT5.exe.42a94a0.3.unpack, type: UNPACKEDPE |
Source: Yara match |
File source: 00000000.00000002.559974818.00000000042A9000.00000004.00000040.sdmp, type: MEMORY |