Windows Analysis Report nxHHI8WXqt.exe

Overview

General Information

Sample Name: nxHHI8WXqt.exe
Analysis ID: 528801
MD5: f65b0793251364c03d06e8e7134fc21b
SHA1: 7bc80e89bbc7c10b974462e748849f9056d20d4a
SHA256: a031918e001745c0f07d5d0ac118a0bfeb946236033e20fa1b16e0d54ee7bcb8
Tags: AgentTeslaexe
Infos:

Most interesting Screenshot:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM3
Multi AV Scanner detection for dropped file
Tries to steal Mail credentials (via file / registry access)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
.NET source code contains potential unpacker
Sigma detected: Powershell Defender Exclusion
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Uses SMTP (mail sending)
Creates a window with clipboard capturing capabilities
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "dubai@skycomex.com", "Password": "@EHbqYU1", "Host": "us2.smtp.mailhostbox.com"}
Multi AV Scanner detection for submitted file
Source: nxHHI8WXqt.exe Virustotal: Detection: 26% Perma Link
Source: nxHHI8WXqt.exe ReversingLabs: Detection: 25%
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\SzfukVRF.exe ReversingLabs: Detection: 25%
Antivirus or Machine Learning detection for unpacked file
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.4.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.6.unpack Avira: Label: TR/Spy.Gen8
Source: 18.0.nxHHI8WXqt.exe.400000.8.unpack Avira: Label: TR/Spy.Gen8

Compliance:

barindex
Uses 32bit PE files
Source: nxHHI8WXqt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: nxHHI8WXqt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking:

barindex
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 208.91.198.143 208.91.198.143
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 208.91.198.143:587
Uses SMTP (mail sending)
Source: global traffic TCP traffic: 192.168.2.3:49745 -> 208.91.198.143:587
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: http://DynDns.comDynDNS
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: http://PClGeN.com
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: nxHHI8WXqt.exe, 00000012.00000002.559071890.00000000032A7000.00000004.00000001.sdmp String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%$
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: https://api.ipify.org%GETMozilla/5.0
Source: nxHHI8WXqt.exe, 00000012.00000002.559001330.0000000003270000.00000004.00000001.sdmp String found in binary or memory: https://uvZLQjYprvsPcwavb.net
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: https://uvZLQjYprvsPcwavb.net4
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, nxHHI8WXqt.exe, 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: nxHHI8WXqt.exe, 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha
Source: unknown DNS traffic detected: queries for: us2.smtp.mailhostbox.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a window with clipboard capturing capabilities
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Window created: window name: CLIPBRDWNDCLASS Jump to behavior

System Summary:

barindex
.NET source code contains very large array initializations
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs Large array initialization: .cctor: array initializer size 12035
Source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b58494291u002d801Du002d4F82u002dA213u002d350FC89214C0u007d/u0034EFFEBBBu002d9C57u002d41F6u002dB4B3u002d5EB0A7648FCF.cs Large array initialization: .cctor: array initializer size 12035
Uses 32bit PE files
Source: nxHHI8WXqt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Detected potential crypto function
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_015A8250 3_2_015A8250
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_015AD2E8 3_2_015AD2E8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_05865AA0 3_2_05865AA0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_05865AB0 3_2_05865AB0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_01144920 18_2_01144920
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_01143E6C 18_2_01143E6C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_01144912 18_2_01144912
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_011455F0 18_2_011455F0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AE6C0 18_2_013AE6C0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013A68F8 18_2_013A68F8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013A5B98 18_2_013A5B98
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AF160 18_2_013AF160
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AB190 18_2_013AB190
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_01441608 18_2_01441608
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_06156DA0 18_2_06156DA0
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_061570E8 18_2_061570E8
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_06159978 18_2_06159978
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_061579B8 18_2_061579B8
Sample file is different than original file name gathered from version info
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.310350535.00000000064E0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.304084320.0000000000D8E000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.310033177.0000000006160000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000000.298656476.0000000000ABE000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamemSjcVJhzvKQgjsYCOAHWMENu.exe4 vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe, 00000012.00000002.554056761.000000000116A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs nxHHI8WXqt.exe
Source: nxHHI8WXqt.exe Binary or memory string: OriginalFilenameDriveIn.exe. vs nxHHI8WXqt.exe
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\SzfukVRF.exe A031918E001745C0F07D5D0AC118A0BFEB946236033E20FA1B16E0D54EE7BCB8
Source: nxHHI8WXqt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SzfukVRF.exe.3.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: nxHHI8WXqt.exe Virustotal: Detection: 26%
Source: nxHHI8WXqt.exe ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File read: C:\Users\user\Desktop\nxHHI8WXqt.exe:Zone.Identifier Jump to behavior
Source: nxHHI8WXqt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe "C:\Users\user\Desktop\nxHHI8WXqt.exe"
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File created: C:\Users\user\AppData\Roaming\SzfukVRF.exe Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File created: C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@9/8@1/1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6676:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_01
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Mutant created: \Sessions\1\BaseNamedObjects\hFVAGeNDDuOIYKYzrWNabcGxrk
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Mutant created: \Sessions\1\BaseNamedObjects\Global\.net data provider for sqlserver
Source: nxHHI8WXqt.exe String found in binary or memory: /DriveIn;component/views/addbook.xaml
Source: nxHHI8WXqt.exe String found in binary or memory: views/addcustomer.baml
Source: nxHHI8WXqt.exe String found in binary or memory: views/addbook.baml
Source: nxHHI8WXqt.exe String found in binary or memory: /DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe String found in binary or memory: /DriveIn;component/views/addbook.xaml
Source: nxHHI8WXqt.exe String found in binary or memory: views/addbook.baml
Source: nxHHI8WXqt.exe String found in binary or memory: views/addcustomer.baml
Source: nxHHI8WXqt.exe String found in binary or memory: /DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe String found in binary or memory: K/DriveIn;component/views/addbook.xamla/DriveIn;component/views/borrowfrombookview.xamlW/DriveIn;component/views/borrowingview.xamlQ/DriveIn;component/views/changebook.xamlY/DriveIn;component/views/changecustomer.xamlU/DriveIn;component/views/customerview.xamlY/DriveIn;component/views/deletecustomer.xamlO/DriveIn;component/views/errorview.xamlS/DriveIn;component/views/smallextras.xamlS/DriveIn;component/views/addcustomer.xaml
Source: nxHHI8WXqt.exe String found in binary or memory: *images/booksimage.jpg$views/addbook.baml1J,views/addcustomer.baml
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, A/b2.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: nxHHI8WXqt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: nxHHI8WXqt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: nxHHI8WXqt.exe, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: SzfukVRF.exe.3.dr, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.2.nxHHI8WXqt.exe.d10000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 3.0.nxHHI8WXqt.exe.d10000.0.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.2.nxHHI8WXqt.exe.a40000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.11.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.2.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.9.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 18.0.nxHHI8WXqt.exe.a40000.1.unpack, Biblan/Views/MainWindow.cs .Net Code: ObjectIdentifier System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_00D19347 push ds; ret 3_2_00D1934C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_00D192F5 push ds; ret 3_2_00D19340
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_00D19361 push ds; retf 3_2_00D19364
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_05866511 push esp; ret 3_2_0586651D
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_05866578 pushad ; ret 3_2_05866585
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 3_2_058656E0 push esp; iretd 3_2_058656E9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_00A49361 push ds; retf 18_2_00A49364
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_00A492F5 push ds; ret 18_2_00A49340
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_00A49347 push ds; ret 18_2_00A4934C
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD51A push cs; iretd 18_2_013AD5A1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD64E pushad ; iretd 18_2_013AD651
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD6E6 pushad ; iretd 18_2_013AD6E9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD6DE pushad ; iretd 18_2_013AD6E1
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD6D6 pushad ; iretd 18_2_013AD6D9
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013AD6CE pushad ; iretd 18_2_013AD6D1
Source: initial sample Static PE information: section name: .text entropy: 7.88557099769
Source: initial sample Static PE information: section name: .text entropy: 7.88557099769

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File created: C:\Users\user\AppData\Roaming\SzfukVRF.exe Jump to dropped file

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.3188dec.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: nxHHI8WXqt.exe, 00000003.00000002.305015661.0000000003121000.00000004.00000001.sdmp, nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -18446744073709540s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5180 Thread sleep count: 3929 > 30 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239837s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239710s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5180 Thread sleep count: 4148 > 30 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5948 Thread sleep time: -30128s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239584s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239468s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239358s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239245s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -239109s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238996s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238844s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238711s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238182s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -238046s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237937s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237812s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237594s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237250s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237140s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -237031s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236922s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236811s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236703s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236593s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236484s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236373s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236262s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236156s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -236046s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -235687s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -235141s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -235009s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234885s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234750s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234639s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234531s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234420s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234306s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234185s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -234078s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -233951s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -233843s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -233734s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -233625s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -233437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -232437s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -231797s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -231312s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 4848 Thread sleep time: -231202s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 5496 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 6396 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6724 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7092 Thread sleep time: -21213755684765971s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7096 Thread sleep count: 1245 > 30 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe TID: 7096 Thread sleep count: 8607 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239837 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239710 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239584 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239468 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239358 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239245 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239109 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238996 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238844 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238711 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238594 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238312 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238182 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238046 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237937 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237812 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237703 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237594 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237250 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237140 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237031 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236922 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236811 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236703 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236593 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236484 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236373 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236262 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236156 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236046 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235687 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235141 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235009 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234885 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234750 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234639 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234531 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234420 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234306 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234185 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234078 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233951 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233843 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233734 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233625 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 232437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231797 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231312 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231202 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Window / User API: threadDelayed 3929 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Window / User API: threadDelayed 4148 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6149 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2154 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Window / User API: threadDelayed 1245 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Window / User API: threadDelayed 8607 Jump to behavior
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 240000 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239837 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239710 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 30128 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239584 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239468 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239358 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239245 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 239109 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238996 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238844 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238711 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238594 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238312 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238182 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 238046 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237937 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237812 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237703 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237594 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237250 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237140 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 237031 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236922 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236811 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236703 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236593 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236484 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236373 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236262 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236156 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 236046 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235687 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235141 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 235009 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234885 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234750 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234639 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234531 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234420 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234306 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234185 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 234078 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233951 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233843 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233734 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233625 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 233437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 232437 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231797 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231312 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 231202 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: vmware
Source: nxHHI8WXqt.exe, 00000012.00000002.554939099.0000000001201000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: nxHHI8WXqt.exe, 00000003.00000002.305431251.0000000003268000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Enables debug privileges
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_013A0A70 LdrInitializeThunk,KiUserExceptionDispatcher,KiUserExceptionDispatcher, 18_2_013A0A70
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SzfukVRF.exe Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SzfukVRF" /XML "C:\Users\user\AppData\Local\Temp\tmp2EEC.tmp Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Process created: C:\Users\user\Desktop\nxHHI8WXqt.exe C:\Users\user\Desktop\nxHHI8WXqt.exe Jump to behavior
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp Binary or memory string: Progman
Source: nxHHI8WXqt.exe, 00000012.00000002.557188776.0000000001900000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Users\user\Desktop\nxHHI8WXqt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Data.Linq.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Users\user\Desktop\nxHHI8WXqt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Code function: 18_2_061553AC GetUserNameW, 18_2_061553AC

Stealing of Sensitive Information:

barindex
Yara detected AgentTesla
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.4255658.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.421f438.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\ Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\nxHHI8WXqt.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR

Remote Access Functionality:

barindex
Yara detected AgentTesla
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.4255658.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.nxHHI8WXqt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.421f438.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.nxHHI8WXqt.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.421f438.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.nxHHI8WXqt.exe.4255658.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.301853445.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.302484338.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.550983065.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.300499752.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.301120055.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.306747115.000000000412D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.558386692.0000000002F41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 5860, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: nxHHI8WXqt.exe PID: 6728, type: MEMORYSTR